What is the CVSS score of CVE-2014-7911?

CVE-2014-7911 has a CVSS 2.0 base score of 7.2 (High). CVSS vector: AV:L/AC:L/Au:N/C:C/I:C/A:C. EPSS exploitation probability: 82.2%.

Java CVE-2014-7911

HIGH

Permissions, Privileges, and Access Controls (CWE-264)

2014-12-15 chrome-cve-admin@google.com

Deserialization Google Java RCE Privilege Escalation Android

7.2

CVSS 2.0 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:L/AC:L/Au:N/C:C/I:C/A:C

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:L/AC:L/Au:N/C:C/I:C/A:C

Attack Vector

Local

Attack Complexity

Low

Confidentiality

Integrity

Availability

Lifecycle Timeline

CVE Published

Dec 15, 2014 - 18:59 cve.org

HIGH 7.2

DescriptionCVE.org

luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0.0 does not verify that deserialization will result in an object that met the requirements for serialization, which allows attackers to execute arbitrary code via a crafted finalize method for a serialized object in an ArrayMap Parcel within an intent sent to system_service, as demonstrated by the finalize method of android.os.BinderProxy, aka Bug 15874291.

AnalysisAI

luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0.0 does not verify that deserialization will result in an object that met the. Rated high severity (CVSS 7.2), this vulnerability is low attack complexity. Epss exploitation probability 82.2% and no vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-264. luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0.0 does not verify that deserialization will result in an object that met the requirements for serialization, which allows attackers to execute arbitrary code via a crafted finalize method for a serialized object in an ArrayMap Parcel within an intent sent to system_service, as demonstrated by the finalize method of android.os.BinderProxy, aka Bug 15874291. Affected products include: Google Android. Version information: before 5.0.0.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.