CVSS 3.1
7.8 highCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HCVE-2020-24164
High (7.8) in taoensso nippy. EPSS 1.1% chance of exploitation in the next 30 days. Fixed in com.taoensso:nippy 2.14.2.
A deserialization flaw is present in Taoensso Nippy before 2.14.2. In some circumstances, it is possible for an attacker to create a malicious payload that, when deserialized, will allow arbitrary code to be executed. This occurs because there is automatic use of the Java Serializable interface.
Severity
- EPSS
- 1.1% chance of exploitation in the next 30 days; higher than 66% of CVEs (scores of 2026-10-31)
- CWE
- CWE-502
- Published
- Modified
- Record from
- the NVD, synced
Affected
- taoensso:nippy
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-p5gm-fgfx-hr7h | Maven | com.taoensso:nippy | <2.14.2 | 2.14.2 |