Django REST framework

Lookup for vulnerabilities affecting packages.

Vulnerability_id VCID-4kfq-t1ez-myb4

Summary sofa-hessian is an internal improved version of Hessian3/4 powered by Ant Group CO., Ltd. The SOFA Hessian protocol uses a blacklist mechanism to restrict deserialization of potentially dangerous classes for security protection. But there is a gadget chain that can bypass the SOFA Hessian blacklist protection mechanism, and this gadget chain only relies on JDK and does not rely on any third-party components. This issue is fixed by an update to the blacklist, users can upgrade to sofahessian version 3.5.5 to avoid this issue. Users unable to upgrade may maintain a blacklist themselves in the directory `external/serialize.blacklist`.

Aliases

alias	CVE-2024-46983

alias	GHSA-c459-2m73-67hj

Fixed_packages

url	pkg:maven/com.alipay.sofa/hessian@3.5.5
purl	pkg:maven/com.alipay.sofa/hessian@3.5.5
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:maven/com.alipay.sofa/hessian@3.5.5

Affected_packages

url pkg:maven/com.alipay.sofa/hessian@3.3.0

purl pkg:maven/com.alipay.sofa/hessian@3.3.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-4kfq-t1ez-myb4

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/com.alipay.sofa/hessian@3.3.0

url pkg:maven/com.alipay.sofa/hessian@3.3.1

purl pkg:maven/com.alipay.sofa/hessian@3.3.1

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-4kfq-t1ez-myb4

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/com.alipay.sofa/hessian@3.3.1

url pkg:maven/com.alipay.sofa/hessian@3.3.2

purl pkg:maven/com.alipay.sofa/hessian@3.3.2

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-4kfq-t1ez-myb4

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/com.alipay.sofa/hessian@3.3.2

url pkg:maven/com.alipay.sofa/hessian@3.3.3

purl pkg:maven/com.alipay.sofa/hessian@3.3.3

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-4kfq-t1ez-myb4

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/com.alipay.sofa/hessian@3.3.3

url pkg:maven/com.alipay.sofa/hessian@3.3.4

purl pkg:maven/com.alipay.sofa/hessian@3.3.4

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-4kfq-t1ez-myb4

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/com.alipay.sofa/hessian@3.3.4

url pkg:maven/com.alipay.sofa/hessian@3.3.5

purl pkg:maven/com.alipay.sofa/hessian@3.3.5

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-4kfq-t1ez-myb4

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/com.alipay.sofa/hessian@3.3.5

url pkg:maven/com.alipay.sofa/hessian@3.3.6

purl pkg:maven/com.alipay.sofa/hessian@3.3.6

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-4kfq-t1ez-myb4

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/com.alipay.sofa/hessian@3.3.6

url pkg:maven/com.alipay.sofa/hessian@3.3.7

purl pkg:maven/com.alipay.sofa/hessian@3.3.7

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-4kfq-t1ez-myb4

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/com.alipay.sofa/hessian@3.3.7

url pkg:maven/com.alipay.sofa/hessian@3.3.8

purl pkg:maven/com.alipay.sofa/hessian@3.3.8

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-4kfq-t1ez-myb4

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/com.alipay.sofa/hessian@3.3.8

url pkg:maven/com.alipay.sofa/hessian@3.3.9

purl pkg:maven/com.alipay.sofa/hessian@3.3.9

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-4kfq-t1ez-myb4

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/com.alipay.sofa/hessian@3.3.9

url pkg:maven/com.alipay.sofa/hessian@3.3.10

purl pkg:maven/com.alipay.sofa/hessian@3.3.10

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-4kfq-t1ez-myb4

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/com.alipay.sofa/hessian@3.3.10

url pkg:maven/com.alipay.sofa/hessian@3.3.11

purl pkg:maven/com.alipay.sofa/hessian@3.3.11

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-4kfq-t1ez-myb4

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/com.alipay.sofa/hessian@3.3.11

url pkg:maven/com.alipay.sofa/hessian@3.3.12

purl pkg:maven/com.alipay.sofa/hessian@3.3.12

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-4kfq-t1ez-myb4

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/com.alipay.sofa/hessian@3.3.12

url pkg:maven/com.alipay.sofa/hessian@3.3.13

purl pkg:maven/com.alipay.sofa/hessian@3.3.13

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-4kfq-t1ez-myb4

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/com.alipay.sofa/hessian@3.3.13

url pkg:maven/com.alipay.sofa/hessian@3.4.0

purl pkg:maven/com.alipay.sofa/hessian@3.4.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-4kfq-t1ez-myb4

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/com.alipay.sofa/hessian@3.4.0

url pkg:maven/com.alipay.sofa/hessian@3.5.0-beta1

purl pkg:maven/com.alipay.sofa/hessian@3.5.0-beta1

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-4kfq-t1ez-myb4

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/com.alipay.sofa/hessian@3.5.0-beta1

url pkg:maven/com.alipay.sofa/hessian@3.5.0

purl pkg:maven/com.alipay.sofa/hessian@3.5.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-4kfq-t1ez-myb4

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/com.alipay.sofa/hessian@3.5.0

url pkg:maven/com.alipay.sofa/hessian@3.5.1

purl pkg:maven/com.alipay.sofa/hessian@3.5.1

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-4kfq-t1ez-myb4

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/com.alipay.sofa/hessian@3.5.1

url pkg:maven/com.alipay.sofa/hessian@3.5.2

purl pkg:maven/com.alipay.sofa/hessian@3.5.2

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-4kfq-t1ez-myb4

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/com.alipay.sofa/hessian@3.5.2

url pkg:maven/com.alipay.sofa/hessian@3.5.3

purl pkg:maven/com.alipay.sofa/hessian@3.5.3

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-4kfq-t1ez-myb4

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/com.alipay.sofa/hessian@3.5.3

url pkg:maven/com.alipay.sofa/hessian@3.5.4

purl pkg:maven/com.alipay.sofa/hessian@3.5.4

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-4kfq-t1ez-myb4

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/com.alipay.sofa/hessian@3.5.4

References

reference_url

https://api.first.org/data/v1/epss?cve=CVE-2024-46983

reference_id

reference_type

scores

value	0.00212
scoring_system	epss
scoring_elements	0.43969
published_at	2026-06-12T12:55:00Z

value	0.00212
scoring_system	epss
scoring_elements	0.43814
published_at	2026-06-11T12:55:00Z

url

https://api.first.org/data/v1/epss?cve=CVE-2024-46983

reference_url

https://github.com/sofastack/sofa-hessian

reference_id

reference_type

scores

value	9.8
scoring_system	cvssv3.1
scoring_elements	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

value	8.1
scoring_system	cvssv4
scoring_elements	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U

value	HIGH
scoring_system	generic_textual
scoring_elements

url

https://github.com/sofastack/sofa-hessian

reference_url

https://github.com/sofastack/sofa-hessian/commit/764ef4b216aee6aeb4b111aec8947a4e8b53bb87

reference_id

reference_type

scores

value	9.8
scoring_system	cvssv3.1
scoring_elements	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

value	8.1
scoring_system	cvssv4
scoring_elements	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U

value	HIGH
scoring_system	generic_textual
scoring_elements

url

https://github.com/sofastack/sofa-hessian/commit/764ef4b216aee6aeb4b111aec8947a4e8b53bb87

reference_url

https://nvd.nist.gov/vuln/detail/CVE-2024-46983

reference_id

CVE-2024-46983

reference_type

scores

value	9.8
scoring_system	cvssv3.1
scoring_elements	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

value	8.1
scoring_system	cvssv4
scoring_elements	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U

value	HIGH
scoring_system	generic_textual
scoring_elements

url

https://nvd.nist.gov/vuln/detail/CVE-2024-46983

reference_url

https://github.com/advisories/GHSA-c459-2m73-67hj

reference_id

GHSA-c459-2m73-67hj

reference_type

scores

value	HIGH
scoring_system	cvssv3.1_qr
scoring_elements

url

https://github.com/advisories/GHSA-c459-2m73-67hj

reference_url

https://github.com/sofastack/sofa-hessian/security/advisories/GHSA-c459-2m73-67hj

reference_id

GHSA-c459-2m73-67hj

reference_type

scores

value	9.8
scoring_system	cvssv3.1
scoring_elements	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

value	HIGH
scoring_system	cvssv3.1_qr
scoring_elements

value	8.1
scoring_system	cvssv4
scoring_elements	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U

value	HIGH
scoring_system	generic_textual
scoring_elements

value	Track
scoring_system	ssvc
scoring_elements	SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2024-09-20T13:55:42Z/

url

https://github.com/sofastack/sofa-hessian/security/advisories/GHSA-c459-2m73-67hj

Weaknesses

cwe_id	74
name	Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
description	The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

cwe_id	502
name	Deserialization of Untrusted Data
description	The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

cwe_id	937
name	OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
description	Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013.

cwe_id	1035
name	OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
description	Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017.

Exploits

Severity_range_score 7.0 - 9.8

Exploitability 0.5

Weighted_severity 8.8

Risk_score 4.4

Resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-4kfq-t1ez-myb4

Vulnerability Instance