CVE-2024-43383

Katalog CVE

CVSS 8.1 · High EPSS 1,2%

Kerentanan Deserialization of Untrusted Data pada apache lucene.net. Skor CVSS 3.1 8.1 (High) menurut NVD.

Deskripsi (NVD)

Deserialization of Untrusted Data vulnerability in Apache Lucene.Net.Replicator. This issue affects Apache Lucene.NET's Replicator library: from 4.8.0-beta00005 through 4.8.0-beta00016. An attacker that can intercept traffic between a replication client and server, or control the target replication node URL, can provide a specially-crafted JSON response that is deserialized as an attacker-provided exception type. This can result in remote code execution or other potential unauthorized access. Users are recommended to upgrade to version 4.8.0-beta00017, which fixes the issue.

Rincian

Terbit di NVD

31 Oktober 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.1 (High), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-502: Deserialization of Untrusted Data

EPSS (30 hari)

1,2% peluang dieksploitasi; lebih tinggi dari 67,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://lists.apache.org/thread/wlz1p76dxpt4rl9o29voxjd5zl7717nh mailing list
• http://www.openwall.com/lists/oss-security/2024/10/31/2 mailing list