CVE-2024-45772

MEDIUM

5.1

Description

Deserialization of Untrusted Data vulnerability in Apache Lucene Replicator. This issue affects Apache Lucene's replicator module: from 4.4.0 before 9.12.0. The deprecated org.apache.lucene.replicator.http package is affected. The org.apache.lucene.replicator.nrt package is not affected. Users are recommended to upgrade to version 9.12.0, which fixes the issue. The deserialization can only be triggered if users actively deploy an network-accessible implementation and a corresponding client using a HTTP library that uses the API (e.g., a custom servlet and HTTPClient). Java serialization filters (such as -Djdk.serialFilter='!*' on the commandline) can mitigate the issue on vulnerable versions without impacting functionality.

Details CVE

Score CVSS v3.15.1

SeveriteMEDIUM

Vecteur CVSSCVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L

Vecteur d'attaqueADJACENT_NETWORK

ComplexiteHIGH

Privileges requisHIGH

Interaction utilisateurNONE

Publie9/30/2024

Derniere modification5/15/2025

Sourcenvd

Observations honeypot0

Produits affectes

apache:lucene_replicator

Faiblesses (CWE)

CWE-502CWE-502

References

https://lists.apache.org/thread/3f3oph7bqnqspb9q5p0gm5mgc1b6thjo(security@apache.org)

http://www.openwall.com/lists/oss-security/2024/09/29/1(af854a3a-2127-422b-91ae-364da2661108)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.