WaratekVRT Sign in

Drools CVEs

6 CVEs, 4 protected by Waratek

Reset
More filters (1)
Columns
Product drools✕
Overview 6 matches · 4 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
6matches 4protected66.7% 0exploited0.0% 0CISA KEV0.0% 0public PoC0.0% 0EPSS ≥ 0.50.0%
Protected by Waratek 4 66.7% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 2 33.3%
Critical 1 16.7% High 3 50.0% Medium 2 33.3% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 4 66.7% partly blocked 0 0.0% not blocked 2 33.3% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 6 100.0%
split by peak 1 / year
No exploit published: 2Protected by Waratek: 4 Medium: 2High: 3Critical: 1 not blocked: 2blocked by ARMR today: 4 No public exploit: 6
20101 No exploit published1 High1 not blocked1 No public exploit1 20110 20120 20130 20141 No exploit published1 Medium1 not blocked1 No public exploit1 20151 Protected by Waratek1 High1 blocked by ARMR today1 No public exploit1 20160 20170 20181 Protected by Waratek1 Medium1 blocked by ARMR today1 No public exploit1 20190 20200 20210 20221 Protected by Waratek1 Critical1 blocked by ARMR today1 No public exploit1 20231 Protected by Waratek1 High1 blocked by ARMR today1 No public exploit1
2011201320152017201920212023
6 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2022-1415 High 2023-09-11 Protected by Waratek No public exploit A flaw was found where some utility classes in Drools core did not use proper safeguards when deserializing data. This flaw allows an authenticated attacker to construct malicious serialized objects (usually called gadgets) and achieve code execution on the server.
CVE-2021-41411 Critical 2022-06-16 Protected by Waratek No public exploit drools <=7.59.x is affected by an XML External Entity (XXE) vulnerability in KieModuleMarshaller.java. The Validator class is not used correctly, resulting in the XXE injection vulnerability.
CVE-2016-7041 Medium 2018-09-10 Protected by Waratek No public exploit Drools Workbench contains a path traversal vulnerability. The vulnerability allows a remote, authenticated attacker to bypass the directory restrictions and retrieve arbitrary files from the affected host.
CVE-2014-8125 High 2015-04-21 Protected by Waratek No public exploit XML external entity (XXE) vulnerability in Drools and jBPM before 6.2.0 allows remote attackers to read arbitrary files or possibly have other unspecified impact via a crafted BPMN2 file.
CVE-2013-6468 Medium 2014-04-10 No exploit published No public exploit JBoss Drools, Red Hat JBoss BRMS before 6.0.1, and Red Hat JBoss BPM Suite before 6.0.1 allows remote authenticated users to execute arbitrary Java code via a (1) MVFLEX Expression Language (MVEL) or (2) Drools expression.
CVE-2010-3708 High 2010-12-30 No exploit published No public exploit The serialization implementation in JBoss Drools in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.3 before 4.3.0.CP09 and JBoss Enterprise SOA Platform 4.2 and 4.3 supports the embedding of class files, which allows remote attackers to execute arbitrary code via a crafted static initializer.