Vulnerability · Published Jun 3, 2020 · Assigned by apache
CVE-2020-1963
Critical 9.1
In plain English
A critical-severity security flaw in Apache Ignite. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 5.0% (higher than 92% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)9.1Critical
Exploit odds (30 days)5.0%top 7.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Apache Ignite uses H2 database to build SQL distributed execution engine. H2 provides SQL functions which could be used by attacker to access to a filesystem.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.apache.ignite:ignite-core | 2.8.1 | GHSA-5wm5-8q42-rhxg |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | Apache Ignite | All versions of Apache Ignite up to 2.8 |
References
- [oss-security] 20200603 [CVE-2020-1963] Apache Ignite access to file system disclosure vulnerability mailing-list, x_refsource_MLIST
- [ignite-user] 20200603 RE: [CVE-2020-1963] Apache Ignite access to file system disclosure vulnerability mailing-list, x_refsource_MLIST
- [ignite-dev] 20200603 RE: [CVE-2020-1963] Apache Ignite access to file system disclosure vulnerability mailing-list, x_refsource_MLIST
- [ignite-dev] 20200605 Re: [CVE-2020-1963] Apache Ignite access to file system disclosure vulnerability mailing-list, x_refsource_MLIST
- [ignite-dev] 20200608 Re: [CVE-2020-1963] Apache Ignite access to file system disclosure vulnerability mailing-list, x_refsource_MLIST
- [ignite-user] 20200609 Re: [CVE-2020-1963] Apache Ignite access to file system disclosure vulnerability mailing-list, x_refsource_MLIST
- [ignite-dev] 20200615 Re: [CVE-2020-1963] Apache Ignite access to file system disclosure vulnerability mailing-list, x_refsource_MLIST
- [ignite-user] 20200615 Re: [CVE-2020-1963] Apache Ignite access to file system disclosure vulnerability mailing-list, x_refsource_MLIST
- https://www.oracle.com/security-alerts/cpujan2022.html x_refsource_MISC
- https://lists.apache.org/thread.html/r1933faf8a26c431f38a5f8dbbfab80254454e54e33a79be474b67dc4%40%3Cdev.ignite.apache.org%3E x_refsource_MISC