Lucene search

ApacheCVE-2024-22399

HistorySep 16, 2024 - 12:15 p.m.

CVE-2024-22399

2024-09-1612:15:02

CWE-502

apache

web.nvd.nist.gov

apache seata

untrusted data

deserialization vulnerability

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

6.8

Confidence

High

EPSS

0.002

Percentile

55.3%

JSON

Deserialization of Untrusted Data vulnerability in Apache Seata.

When developers disable authentication on the Seata-Server and do not use the Seata client SDK dependencies, they may construct uncontrolled serialized malicious requests by directly sending bytecode based on the Seata private protocol.

This issue affects Apache Seata: 2.0.0, from 1.0.0 through 1.8.0.

Users are recommended to upgrade to version 2.1.0/1.8.1, which fixes the issue.

Affected configurations

Nvd

Vulners

Vulnrichment

Node

apacheseataRange1.0.0–1.8.1

apacheseataMatch2.0.0

VendorProductVersionCPE
apacheseata*cpe:2.3:a:apache:seata:*:*:*:*:*:*:*:*
apacheseata2.0.0cpe:2.3:a:apache:seata:2.0.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
apache	seata	*	cpe:2.3:a:apache:seata::::::::
apache	seata	2.0.0	cpe:2.3:a:apache:seata:2.0.0:::::::*

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "packageName": "io.seata:seata-all",
    "product": "Apache Seata",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "status": "affected",
        "version": "2.0.0",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "1.8.0",
        "status": "affected",
        "version": "1.0.0",
        "versionType": "semver"
      }
    ]
  }
]

References

lists.apache.org/thread/91nzzlxyj4nmks85gbzwkkjtbmnmlkc4

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

6.8

Confidence

High

EPSS

0.002

Percentile

55.3%

JSON

Related for CVE-2024-22399