Obp Api
Monthly
OpenBankProject OBP-API builds up to and including 1.10.1 deserialize attacker-controlled data through the KryoInjection.invert routine in the Redis cache handler (code/api/cache/Redis.scala), which can lead to code execution or data tampering by anyone able to plant a crafted Kryo-serialized object in the API's Redis cache. Exploitation is rated difficult: the supplied CVSS 4.0 vector requires high privileges (PR:H) and high attack complexity (AC:H), and the scored impact is limited (VC:L/VI:L/VA:L, score 1.2). Public exploit material exists via the referenced GitHub issue (GHSA-889g-wggr-jrrq / issue 2888), but there is no CISA KEV confirmation of active exploitation, and the upstream project had not responded to the issue report at the time of analysis.
OpenBankProject OBP-API builds up to and including 1.10.1 deserialize attacker-controlled data through the KryoInjection.invert routine in the Redis cache handler (code/api/cache/Redis.scala), which can lead to code execution or data tampering by anyone able to plant a crafted Kryo-serialized object in the API's Redis cache. Exploitation is rated difficult: the supplied CVSS 4.0 vector requires high privileges (PR:H) and high attack complexity (AC:H), and the scored impact is limited (VC:L/VI:L/VA:L, score 1.2). Public exploit material exists via the referenced GitHub issue (GHSA-889g-wggr-jrrq / issue 2888), but there is no CISA KEV confirmation of active exploitation, and the upstream project had not responded to the issue report at the time of analysis.