CVE-2024-56180

CWE-502 Deserialization of Untrusted Data at the eventmesh-meta-raft plugin module in Apache EventMesh master branch without release version on windows\linux\mac os e.g. platforms allows attackers to send controlled message and remote code execute via hessian deserialization rpc protocol. Users can use the code under the master branch in project repo or version 1.11.0 to fix this issue.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://lists.apache.org/thread/k9fw0t5r7t1vbx53gs8d1r8c54rhx0wd	Mailing List Vendor Advisory Issue Tracking
http://www.openwall.com/lists/oss-security/2025/02/14/7	Mailing List Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:eventmesh:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2025-02-14 14:15

Updated : 2025-07-14 13:07

NVD link : CVE-2024-56180

Mitre link : CVE-2024-56180

CVE.ORG link : CVE-2024-56180

JSON object : View

Products Affected

apache

eventmesh

CWE

CWE-502

Deserialization of Untrusted Data

{"id": "CVE-2024-56180", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2025-02-14T14:15:32.267", "references": [{"url": "https://lists.apache.org/thread/k9fw0t5r7t1vbx53gs8d1r8c54rhx0wd", "tags": ["Mailing List", "Vendor Advisory", "Issue Tracking"], "source": "[email protected]"}, {"url": "http://www.openwall.com/lists/oss-security/2025/02/14/7", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-502"}]}], "descriptions": [{"lang": "en", "value": "CWE-502 Deserialization of Untrusted Data at the eventmesh-meta-raft\u00a0plugin\u00a0module in Apache EventMesh master branch without release version on windows\\linux\\mac os e.g. platforms allows attackers to send controlled message and remote code execute\u00a0via hessian deserialization rpc protocol. Users can use the code under the master branch in project repo or version 1.11.0 to fix this issue."}, {"lang": "es", "value": "CWE-502 La deserializaci\u00f3n de datos no confiables en el m\u00f3dulo de complemento eventmesh-meta-raft en la rama maestra Apache EventMesh sin versi\u00f3n de lanzamiento en plataformas Windows\\Linux\\Mac OS, por ejemplo, permite a los atacantes enviar mensajes controlados y ejecutar c\u00f3digo remoto a trav\u00e9s del protocolo RPC de deserializaci\u00f3n hessiana. Los usuarios pueden usar el c\u00f3digo en la rama maestra en el repositorio del proyecto o la versi\u00f3n 1.11.0 para solucionar este problema."}], "lastModified": "2025-07-14T13:07:40.770", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:eventmesh:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "55CDF7A9-8EB7-43F5-B892-61114CE8669D", "versionEndExcluding": "1.11.0", "versionStartIncluding": "1.10.1"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}