Dromara Sa-Token SaJdkSerializer.java ObjectInputStream.readObject deserialization

2.3 CVSS

Vulnerability Description

A weakness has been identified in Dromara Sa-Token up to 1.44.0. This affects the function ObjectInputStream.readObject of the file SaJdkSerializer.java. Executing manipulation can lead to deserialization. The attack may be launched remotely. This attack is characterized by high complexity. It is indicated that the exploitability is difficult. The vendor was contacted early about this disclosure but did not respond in any way.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-15117

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from Dromara

View All →

CVE-2025-7552

Dromara Northstar Path AuthorizationInterceptor.java preHandle access control

Medium 5.3

CVE-2025-6925

Dromara RuoYi-Vue-Plus Mail MailController.java path traversal

Medium 6.9

CVE-2025-6517

Dromara MaxKey Meta URL SAML20DetailsController.java add server-side request forgery

Medium 5.3

CVE-2025-2491

Dromara ujcms Edit Template File Page WebFileTemplateController.java update cross site scripting

Medium 4.8

CVE-2025-2490

Dromara ujcms File Upload WebFileUploadController.java upload cross site scripting

Medium 4.8

Affected Vendor

Dromara

View all reports →

Affected Software

Sa-Token

Vulnerable Versions:

1.0, 1.1, 1.2, 1.3, 1.4, 1.5, 1.6, 1.7, 1.8, 1.9, 1.10, 1.11, 1.12, 1.13, 1.14, 1.15, 1.16, 1.17, 1.18, 1.19, 1.20, 1.21, 1.22, 1.23, 1.24, 1.25, 1.26, 1.27, 1.28, 1.29, 1.30, 1.31, 1.32, 1.33, 1.34, 1.35, 1.36, 1.37, 1.38, 1.39, 1.40, 1.41, 1.42, 1.43, 1.44.0