onyx --cves cve-2016-1000027
CVE-2016-1000027
- score
- <0.1
- cvss
- 9.8
- epss
- 33.2%
- published
- 2020-01-02
- kev added
- —
- first seen
Pivotal Spring Framework up to 5.3.16 contains a potential remote code execution caused by insecure Java deserialization of untrusted data, letting attackers execute arbitrary code remotely, exploit may require authentication.
Timeline
How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.
- Published
- Tracked by Onyx
- Public PoC
Exploit availability
Public PoC flagged by vulnx; no direct exploit link among the citations.
Weaknesses
References 8
- https://spring.io/blog/2022/05/11/spring-framework-5-3-20-and-5-2-22-available-now
- https://www.tenable.com/security/research/tra-2016-20
- https://security.netapp.com/advisory/ntap-20230420-0009/
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-1000027
- https://github.com/spring-projects/spring-framework/issues/24434#issuecomment-579669626
- https://github.com/spring-projects/spring-framework/issues/24434#issuecomment-582313417
- https://github.com/spring-projects/spring-framework/issues/24434#issuecomment-744519525
- https://security-tracker.debian.org/tracker/CVE-2016-1000027