CVE-2019-9212

CVE-2019-9212 is a critical deserialization vulnerability affecting SOFA-Hessian through version 4.0.2, allowing remote attackers to execute arbitrary commands. This flaw stems from inadequate blacklisting of specific Java classes, enabling the injection of malicious serialized Hessian objects. With a CVSS score of 9.8, it presents a severe risk due to its network-based attack vector, low attack complexity, and potential for complete compromise of confidentiality, integrity, and availability. Despite its critical severity, there is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.