CVE-2017-4995

CVE-2017-4995 describes a deserialization vulnerability in Pivotal Spring Security versions 4.2.0.RELEASE through 4.2.2.RELEASE and Spring Security 5.0.0.M1. This flaw arises when Jackson, configured with global default typing by Spring Security, deserializes untrusted data, potentially leading to arbitrary code execution if an unknown deserialization gadget is present on the classpath. The vulnerability carries a high CVSS score of 8.1, indicating a network-based attack with high impact on confidentiality, integrity, and availability, though it requires high attack complexity. There is no evidence of active exploitation, publicly available exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.