EUVD-2026-30684
GHSA-hwp7-hcx2-p9r2
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was identified in Oinone Pamirs up to 7.2.0. This affects the function JsonUtils.parseMap of the file PamirsParserConfig.java of the component appConfigQuery Interface. Such manipulation leads to deserialization. The attack can be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Unsafe deserialization in Oinone Pamirs versions up to 7.2.0 allows authenticated remote attackers to potentially execute arbitrary code via crafted JSON payloads to the appConfigQuery interface. The vulnerability exists in JsonUtils.parseMap within PamirsParserConfig.java, where attacker-controlled data is deserialized without proper validation. Public exploit code is available on GitHub, though EPSS and KEV data are not provided. CVSS 4.0 score of 2.1 reflects limited scope impact (VC:L/VI:L/VA:L with SC:N/SI:N/SA:N), requiring low-privilege authentication (PR:L) but featuring low attack complexity (AC:L) and network attack vector (AV:N). Vendor non-responsive to disclosure.
Technical ContextAI
This is a Java deserialization vulnerability (CWE-502) affecting the JsonUtils.parseMap function in PamirsParserConfig.java. Oinone Pamirs appears to be a Java-based application with an appConfigQuery interface that accepts JSON input. The vulnerability stems from unsafe deserialization practices where user-supplied JSON data is parsed and converted into Java objects without proper type validation or filtering. CWE-502 (Deserialization of Untrusted Data) is a critical vulnerability class that can lead to remote code execution when malicious serialized objects trigger dangerous operations during the deserialization process. The affected CPE (cpe:2.3:a:oinone:pamirs:*:*:*:*:*:*:*:*) confirms all versions through 7.2.0 are vulnerable. Java deserialization attacks typically exploit gadget chains in commonly used libraries to achieve code execution, making this a well-understood attack pattern in enterprise Java applications.
RemediationAI
No vendor-released patch exists as Oinone did not respond to vulnerability disclosure per VulDB report. Organizations must implement compensating controls: First, restrict network access to the appConfigQuery interface to only trusted administrative networks or systems, using firewall rules or application-layer access controls. Second, implement input validation to reject JSON payloads containing Java serialization markers or suspicious class references before reaching JsonUtils.parseMap - this requires code modification but provides defense-in-depth. Third, run the Pamirs application with minimal privileges using a dedicated service account to limit deserialization gadget chain effectiveness. Fourth, enable Java deserialization filtering (JEP 290 for Java 9+) with strict allow-lists that block dangerous classes like Runtime, ProcessBuilder, and common gadget chain components; this may break legitimate functionality and requires testing. Fifth, monitor application logs for deserialization exceptions or unusual JSON parsing errors as potential exploitation indicators. Consider migrating to alternative products with active security support given vendor non-responsiveness. See exploit details at https://github.com/SourByte05/SourByte-Lab/issues/13 to understand attack patterns for detection rule development.
Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m
Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti
Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent
Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow
Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today