CVE-2024-52577
Critical
Description
In Apache Ignite versions from 2.6.0 and before 2.17.0, configured Class Serialization Filters are ignored for some Ignite endpoints. The vulnerability could be exploited if an attacker manually crafts an Ignite message containing a vulnerable object whose class is present in the Ignite server classpath and sends it to Ignite server endpoints. Deserialization of such a message by the Ignite server may result in the execution of arbitrary code on the Apache Ignite server side.
SeverityCritical
CVSS9.0
Exploit probability—
Product
Apache Ignite
PublishedFeb 14, 2025
First seenFeb 14, 2025
Weakness typeCWE-502Deserialization of untrusted data
How to fix
Update
- apache ignite2.17.0 or later
- org.apache.ignite:ignite-core2.17.0 or later
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache ignite | 2.6.0 ≤ v < 2.17.0 | 2.17.0 |
| org.apache.ignite:ignite-coreMaven | 2.6.0 ≤ v < 2.17.0 | 2.17.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.