{"id":"CVE-2023-24621","aliases":["EUVD-2023-2320","GHSA-jm7r-4pg6-gf26"],"status":"published","title":"Esoteric YamlBeans Unsafe Deserialization vulnerability","description":"An issue was discovered in Esoteric YamlBeans through 1.15. It allows untrusted deserialisation to Java classes by default, where the data and class are controlled by the author of the YAML document being processed.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.00451,"percentile":0.39703,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-502"],"published":"2023-08-25T00:00:00Z","modified":"2026-10-28T02:31:15Z","affected":[{"source":"ghsa","ecosystem":"Maven","package":"com.esotericsoftware.yamlbeans:yamlbeans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.15"}]}]},{"source":"osv","ecosystem":"Maven","package":"com.esotericsoftware.yamlbeans:yamlbeans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.15"}]}],"versions":["1.06","1.08","1.09","1.11","1.12","1.13","1.14","1.15"]}],"products":[{"vendor":"esotericsoftware","product":"yamlbeans"}],"references":[{"url":"https://github.com/EsotericSoftware","tags":["x_transferred","Third Party Advisory","web"]},{"url":"https://contrastsecurity.com","tags":["x_transferred","Third Party Advisory","web"]},{"url":"https://github.com/Contrast-Security-OSS/yamlbeans/blob/main/SECURITY.md","tags":["x_transferred","Exploit","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-24621","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-jm7r-4pg6-gf26"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/24xxx/CVE-2023-24621.json","tags":["advisory"]},{"url":"https://github.com/EsotericSoftware/yamlbeans","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2023-24621","description":"An issue was discovered in Esoteric YamlBeans through 1.15. It allows untrusted deserialisation to Java classes by default, where the data and class are controlled by the author of the YAML document being processed.","status":"published","published":"2023-08-25T00:00:00Z","modified":"2024-10-02T18:06:24.584Z","updated_at":"2026-11-02T14:35:27.006218Z"}],"euvd":[{"id":"EUVD-2023-2320","description":"An issue was discovered in Esoteric YamlBeans through 1.15. It allows untrusted deserialisation to Java classes by default, where the data and class are controlled by the author of the YAML document being processed.","status":"published","published":"2023-08-25T00:00:00Z","modified":"2024-10-02T18:06:24Z","updated_at":"2026-11-03T00:27:57.212945Z"}],"ghsa":[{"id":"GHSA-jm7r-4pg6-gf26","title":"Esoteric YamlBeans Unsafe Deserialization vulnerability","description":"An issue was discovered in Esoteric YamlBeans through 1.15. It allows untrusted deserialisation to Java classes by default, where the data and class are controlled by the author of the YAML document being processed.","status":"published","published":"2023-08-25T21:30:47Z","modified":"2023-11-08T05:00:54Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:37:16.721714Z"}],"nvd":[{"id":"CVE-2023-24621","description":"An issue was discovered in Esoteric YamlBeans through 1.15. It allows untrusted deserialisation to Java classes by default, where the data and class are controlled by the author of the YAML document being processed.","status":"published","published":"2023-08-25T20:15:07.983Z","modified":"2026-06-17T05:39:40.277Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:08:25.025396Z"}],"osv":[{"id":"GHSA-jm7r-4pg6-gf26","title":"Esoteric YamlBeans Unsafe Deserialization vulnerability","description":"An issue was discovered in Esoteric YamlBeans through 1.15. It allows untrusted deserialisation to Java classes by default, where the data and class are controlled by the author of the YAML document being processed.","status":"published","published":"2023-08-25T21:30:47Z","modified":"2024-02-16T08:01:44.760203Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T15:46:50.687609Z"},{"id":"CVE-2023-24621","description":"An issue was discovered in Esoteric YamlBeans through 1.15. It allows untrusted deserialisation to Java classes by default, where the data and class are controlled by the author of the YAML document being processed.","status":"published","published":"2023-08-25T00:00:00Z","modified":"2026-10-28T02:31:15.003303018Z","updated_at":"2026-11-02T15:44:30.709518Z"}]}}