CVE-2022-25167

moderate-risk

Published 2022-06-14

Apache Flume versions 1.4.0 through 1.9.0 are vulnerable to a remote code execution (RCE) attack when a configuration uses a JMS Source with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI to allow only the use of the java protocol or no protocol.

Do I need to act?

10.5% chance of exploitation in next 30 days

EPSS score — higher than 89% of all CVEs

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 9.8/10 Critical

NETWORK / LOW complexity

Affected Products (1)

Flume

Affected Vendors

Apache

References (6)

Mailing List http://www.openwall.com/lists/oss-security/2022/06/14/1

Issue Tracking https://issues.apache.org/jira/browse/FLUME-3416

Broken Link https://lists.apache.org/thread/16nf6b81zjpdc4y93ho99oxo83ddbsvg

Mailing List http://www.openwall.com/lists/oss-security/2022/06/14/1

Issue Tracking https://issues.apache.org/jira/browse/FLUME-3416

Broken Link https://lists.apache.org/thread/16nf6b81zjpdc4y93ho99oxo83ddbsvg

/ 100

moderate-risk

Severity 32/34 · Critical

Exploitability 11/34 · Low

Exposure 5/34 · Minimal