« Volver al listado

CVE-2024-56180

Estado: AnalizadaCrítica (9.8)—

CWE-502 Deserialization of Untrusted Data at the eventmesh-meta-raft plugin module in Apache EventMesh master branch without release version on windows\linux\mac os e.g. platforms allows attackers to send controlled message and remote code execute via hessian deserialization rpc protocol. Users can use the code under the master branch in project repo or version 1.11.0 to fix this issue.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

AV:N/PR:N/UI:N indica red sin autenticación. CWE-502 (deserialización no segura) en protocolo RPC permite ejecución remota de código arbitrary via Hessian deserialization, confirma T1190 e impacto T1059.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account ManagementVulnerability ScanningRestrict Web-Based ContentNetwork SegmentationLimit Software InstallationLimit Access to Resource Over Network

Tecnologías afectadas (1)

Apache — Eventmesh

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-56180",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-56180",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-02-18T15:09:26.643766Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security@apache.org",
      "affectedData": [
        {
          "vendor": "Apache Software Foundation",
          "product": "Apache EventMesh",
          "versions": [
            {
              "status": "affected",
              "version": "1.10.1",
              "lessThan": "1.11.0",
              "versionType": "semver"
            }
          ],
          "packageName": "org.apache.eventmesh:eventmesh-meta-raft",
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-02-14T14:15:32.267",
  "references": [
    {
      "url": "https://lists.apache.org/thread/k9fw0t5r7t1vbx53gs8d1r8c54rhx0wd",
      "tags": [
        "Issue Tracking",
        "Mailing List",
        "Vendor Advisory"
      ],
      "source": "security@apache.org"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2025/02/14/7",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@apache.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-502"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "CWE-502 Deserialization of Untrusted Data at the eventmesh-meta-raft plugin module in Apache EventMesh master branch without release version on windows\\linux\\mac os e.g. platforms allows attackers to send controlled message and remote code execute via hessian deserialization rpc protocol. Users can use the code under the master branch in project repo or version 1.11.0 to fix this issue."
    },
    {
      "lang": "es",
      "value": "CWE-502 La deserialización de datos no confiables en el módulo de complemento eventmesh-meta-raft en la rama maestra Apache EventMesh sin versión de lanzamiento en plataformas Windows\\Linux\\Mac OS, por ejemplo, permite a los atacantes enviar mensajes controlados y ejecutar código remoto a través del protocolo RPC de deserialización hessiana. Los usuarios pueden usar el código en la rama maestra en el repositorio del proyecto o la versión 1.11.0 para solucionar este problema."
    }
  ],
  "lastModified": "2026-06-17T08:11:47.650",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apache:eventmesh:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "55CDF7A9-8EB7-43F5-B892-61114CE8669D",
              "versionEndExcluding": "1.11.0",
              "versionStartIncluding": "1.10.1"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@apache.org"
}