Skip to content
GWT: Unpatched, Unauthenticated Java Deserialization
bishopfox.com | vulnerability | #rce | #web-framework | #gwt | #java-deserialization | #unpatched-vulnerability
Summary
Ben Lincoln details an eight-year-old unauthenticated Java deserialization flaw in GWT that remained unpatched in late 2023; GWT 2.10.1/2.11.0 now disable binary serialization by default.
- Published
- Collected