Dromara Sa-Token SaSerializerTemplateForJdkUseBase64.java ObjectInputStream.readObject deserialization

2.3 CVSS

Vulnerability Description

A vulnerability has been found in Dromara Sa-Token up to 1.44.0. This issue affects the function ObjectInputStream.readObject of the file SaSerializerTemplateForJdkUseBase64.java. Such manipulation leads to deserialization. The attack can be executed remotely. This attack is characterized by high complexity. The exploitability is assessed as difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-15222

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from Dromara

View All →

CVE-2025-7552

Dromara Northstar Path AuthorizationInterceptor.java preHandle access control

Medium 5.3

CVE-2025-6925

Dromara RuoYi-Vue-Plus Mail MailController.java path traversal

Medium 6.9

CVE-2025-6517

Dromara MaxKey Meta URL SAML20DetailsController.java add server-side request forgery

Medium 5.3

CVE-2025-2491

Dromara ujcms Edit Template File Page WebFileTemplateController.java update cross site scripting

Medium 4.8

CVE-2025-2490

Dromara ujcms File Upload WebFileUploadController.java upload cross site scripting

Medium 4.8

Affected Vendor

Dromara

View all reports →

Affected Software

Sa-Token

Vulnerable Versions:

1.0, 1.1, 1.2, 1.3, 1.4, 1.5, 1.6, 1.7, 1.8, 1.9, 1.10, 1.11, 1.12, 1.13, 1.14, 1.15, 1.16, 1.17, 1.18, 1.19, 1.20, 1.21, 1.22, 1.23, 1.24, 1.25, 1.26, 1.27, 1.28, 1.29, 1.30, 1.31, 1.32, 1.33, 1.34, 1.35, 1.36, 1.37, 1.38, 1.39, 1.40, 1.41, 1.42, 1.43, 1.44.0