// For flags

CVE-2024-45772

Apache Lucene Replicator: Security Vulnerability in Lucene Replicator - Deserialization Issue

Severity Score

5.1
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track
*SSVC
Descriptions

Deserialization of Untrusted Data vulnerability in Apache Lucene Replicator.

This issue affects Apache Lucene's replicator module: from 4.4.0 before 9.12.0.
The deprecated org.apache.lucene.replicator.http package is affected.
The org.apache.lucene.replicator.nrt package is not affected.

Users are recommended to upgrade to version 9.12.0, which fixes the issue.

Java serialization filters (such as -Djdk.serialFilter='!*' on the commandline) can mitigate the issue on vulnerable versions without impacting functionality.

Vulnerabilidad de deserialización de datos no confiables en Apache Lucene Replicator. Este problema afecta al módulo replicador de Apache Lucene: desde la versión 4.4.0 hasta la 9.12.0. El paquete obsoleto org.apache.lucene.replicator.http está afectado. El paquete org.apache.lucene.replicator.nrt no está afectado. Se recomienda a los usuarios que actualicen a la versión 9.12.0, que soluciona el problema. Los filtros de serialización de Java (como -Djdk.serialFilter='!*' en la línea de comandos) pueden mitigar el problema en las versiones vulnerables sin afectar la funcionalidad.

*Credits: Summ3r from Vidar-Team, Paul Irwin from Apache Lucene.NET
CVSS Scores
Attack Vector
Adjacent
Attack Complexity
High
Privileges Required
High
User Interaction
None
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
Low
* Common Vulnerability Scoring System
SSVC
  • Decision:Track
Exploitation
None
Automatable
No
Tech. Impact
Partial
* Organization's Worst-case Scenario
Timeline
  • 2024-09-07 CVE Reserved
  • 2024-09-30 CVE Published
  • 2024-10-01 CVE Updated
  • 2024-10-05 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-502: Deserialization of Untrusted Data
CAPEC
References (1)
URL Tag Source
URL Date SRC
URL Date SRC
URL Date SRC
https://lists.apache.org/thread/3f3oph7bqnqspb9q5p0gm5mgc1b6thjo 2024-09-30
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Apache Software Foundation
Search vendor "Apache Software Foundation"
 Apache Lucene Replicator
Search vendor "Apache Software Foundation" for product "Apache Lucene Replicator"
 >= 4.4.0 < 9.12.0
Search vendor "Apache Software Foundation" for product "Apache Lucene Replicator" and version " >= 4.4.0 < 9.12.0"
en
Affected