Vulnerability · Published Feb 14, 2025 · Assigned by apache
CVE-2024-52577Apache Ignite: Possible RCE when deserializing incoming messages by the server node
Critical 9.5
In plain English
A critical-severity unsafe deserialization in Apache Ignite from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.1% (higher than 88% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
In Apache Ignite versions from 2.6.0 and before 2.17.0, configured Class Serialization Filters are ignored for some Ignite endpoints. The vulnerability could be exploited if an attacker manually crafts an Ignite message containing a vulnerable object whose class is present in the Ignite server classpath and sends it to Ignite server endpoints. Deserialization of such a message by the Ignite server may result in the execution of arbitrary code on the Apache Ignite server side.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.apache.ignite:ignite-core | 2.17.0 | GHSA-8355-xj3p-hv6q |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Ignite | 2.6.0 – before 2.17.0 |
Weakness: CWE-502 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H