GHSA-cvcf-w75c-gw5r

Mulesoft Mule Unsafe Deserialization

Source: GitHub Advisory Database (reviewed) Critical CVE-2019-13116

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.mule.runtime:mule	< 3.8.0	3.8.0

Details

As written in the advisory (Markdown source, shown as plain text).

The MuleSoft Mule runtime engine before 3.8.0 allows remote attackers to execute arbitrary code because of Java Deserialization, related to Apache Commons Collections.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2019-13116 advisory
https://docs.mulesoft.com/release-notes/mule-runtime/mule-3.8.0-release-notes web
https://github.com/mulesoft/mule package
https://threat.tevora.com/mulesoft-3-8-unauthenticated-rce web