GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2022-37023 (GCVE-0-2022-37023)

Vulnerability from cvelistv5 – Published: 2022-08-31 07:00 – Updated: 2024-08-03 10:21
VLAI
Title
Apache Geode deserialization of untrusted data flaw when using REST API on Java 8 or Java 11
Summary
Apache Geode versions prior to 1.15.0 are vulnerable to a deserialization of untrusted data flaw when using REST API on Java 8 or Java 11. Any user wishing to protect against deserialization attacks involving REST APIs should upgrade to Apache Geode 1.15 and follow the documentation for details on enabling "validate-serializable-objects=true" and specifying any user classes that may be serialized/deserialized with "serializable-object-filter". Enabling "validate-serializable-objects" may impact performance.
Severity
No CVSS data available.
CWE
  • CWE-502 - Deserialization of Untrusted Data
Assigner
References
Impacted products
Vendor Product Version CPE status
Apache Software Foundation Apache Geode Affected: Apache Geode , < 1.15.0 (custom)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T10:21:32.603Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread/6js89pbqrp52zlpwgry5fsdn76gxbbfj"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "platforms": [
            "Java 8 or 11"
          ],
          "product": "Apache Geode",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "1.15.0",
              "status": "affected",
              "version": "Apache Geode",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Apache Geode versions prior to 1.15.0 are vulnerable to a deserialization of untrusted data flaw when using REST API on Java 8 or Java 11. Any user wishing to protect against deserialization attacks involving REST APIs should upgrade to Apache Geode 1.15 and follow the documentation for details on enabling \"validate-serializable-objects=true\" and specifying any user classes that may be serialized/deserialized with \"serializable-object-filter\". Enabling \"validate-serializable-objects\" may impact performance."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "other": "high - possible RCE"
            },
            "type": "unknown"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "CWE-502 Deserialization of Untrusted Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-08-31T07:00:16.000Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://lists.apache.org/thread/6js89pbqrp52zlpwgry5fsdn76gxbbfj"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Apache Geode deserialization of untrusted data flaw when using REST API on Java 8 or Java 11",
      "workarounds": [
        {
          "lang": "en",
          "value": "Disable affected services such as JMX over RMI or REST APIs unless they are required. REST APIs can be disabled by setting `http-service-port` to zero."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@apache.org",
          "ID": "CVE-2022-37023",
          "STATE": "PUBLIC",
          "TITLE": "Apache Geode deserialization of untrusted data flaw when using REST API on Java 8 or Java 11"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Apache Geode",
                      "version": {
                        "version_data": [
                          {
                            "platform": "Java 8 or 11",
                            "version_affected": "\u003c",
                            "version_name": "Apache Geode",
                            "version_value": "1.15.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Apache Software Foundation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Apache Geode versions prior to 1.15.0 are vulnerable to a deserialization of untrusted data flaw when using REST API on Java 8 or Java 11. Any user wishing to protect against deserialization attacks involving REST APIs should upgrade to Apache Geode 1.15 and follow the documentation for details on enabling \"validate-serializable-objects=true\" and specifying any user classes that may be serialized/deserialized with \"serializable-object-filter\". Enabling \"validate-serializable-objects\" may impact performance."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": [
          {
            "other": "high - possible RCE"
          }
        ],
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-502 Deserialization of Untrusted Data"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://lists.apache.org/thread/6js89pbqrp52zlpwgry5fsdn76gxbbfj",
              "refsource": "MISC",
              "url": "https://lists.apache.org/thread/6js89pbqrp52zlpwgry5fsdn76gxbbfj"
            }
          ]
        },
        "source": {
          "discovery": "UNKNOWN"
        },
        "work_around": [
          {
            "lang": "en",
            "value": "Disable affected services such as JMX over RMI or REST APIs unless they are required. REST APIs can be disabled by setting `http-service-port` to zero."
          }
        ]
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2022-37023",
    "datePublished": "2022-08-31T07:00:16.000Z",
    "dateReserved": "2022-07-29T00:00:00.000Z",
    "dateUpdated": "2024-08-03T10:21:32.603Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-37023",
      "date": "2026-09-16",
      "epss": "0.01632",
      "percentile": "0.75048"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:geode:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"1.15.0\", \"matchCriteriaId\": \"4C0E002C-C0BB-4B86-AF4B-28E90BBF667A\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Apache Geode versions prior to 1.15.0 are vulnerable to a deserialization of untrusted data flaw when using REST API on Java 8 or Java 11. Any user wishing to protect against deserialization attacks involving REST APIs should upgrade to Apache Geode 1.15 and follow the documentation for details on enabling \\\"validate-serializable-objects=true\\\" and specifying any user classes that may be serialized/deserialized with \\\"serializable-object-filter\\\". Enabling \\\"validate-serializable-objects\\\" may impact performance.\"}, {\"lang\": \"es\", \"value\": \"Apache Geode versiones anteriores a 1.15.0, son vulnerables a un fallo de deserializaci\\u00f3n de datos no confiables cuando es usada la API REST en Java versi\\u00f3n 8 o Java versi\\u00f3n 11. Cualquier usuario que desee protegerse contra los ataques de deserializaci\\u00f3n que implican las APIs REST debe actualizar a Apache Geode versi\\u00f3n 1.15 y seguir la documentaci\\u00f3n para detalles sobre la habilitaci\\u00f3n de \\\"validate-serializable-objects=true\\\" y especificar cualquier clase de usuario que pueda ser serializada/de serializada con \\\"serializable-object-filter\\\". Activar \\\"validate-serializable-objects\\\" puede afectar al rendimiento\"}]",
      "id": "CVE-2022-37023",
      "lastModified": "2024-11-21T07:14:18.380",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 6.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 2.8, \"impactScore\": 3.6}]}",
      "published": "2022-08-31T07:15:07.420",
      "references": "[{\"url\": \"https://lists.apache.org/thread/6js89pbqrp52zlpwgry5fsdn76gxbbfj\", \"source\": \"security@apache.org\", \"tags\": [\"Mailing List\", \"Vendor Advisory\"]}, {\"url\": \"https://lists.apache.org/thread/6js89pbqrp52zlpwgry5fsdn76gxbbfj\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mailing List\", \"Vendor Advisory\"]}]",
      "sourceIdentifier": "security@apache.org",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"security@apache.org\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-502\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-502\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-37023\",\"sourceIdentifier\":\"security@apache.org\",\"published\":\"2022-08-31T07:15:07.420\",\"lastModified\":\"2026-06-17T04:54:29.317\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Apache Geode versions prior to 1.15.0 are vulnerable to a deserialization of untrusted data flaw when using REST API on Java 8 or Java 11. Any user wishing to protect against deserialization attacks involving REST APIs should upgrade to Apache Geode 1.15 and follow the documentation for details on enabling \\\"validate-serializable-objects=true\\\" and specifying any user classes that may be serialized/deserialized with \\\"serializable-object-filter\\\". Enabling \\\"validate-serializable-objects\\\" may impact performance.\"},{\"lang\":\"es\",\"value\":\"Apache Geode versiones anteriores a 1.15.0, son vulnerables a un fallo de deserializaci\u00f3n de datos no confiables cuando es usada la API REST en Java versi\u00f3n 8 o Java versi\u00f3n 11. Cualquier usuario que desee protegerse contra los ataques de deserializaci\u00f3n que implican las APIs REST debe actualizar a Apache Geode versi\u00f3n 1.15 y seguir la documentaci\u00f3n para detalles sobre la habilitaci\u00f3n de \\\"validate-serializable-objects=true\\\" y especificar cualquier clase de usuario que pueda ser serializada/de serializada con \\\"serializable-object-filter\\\". Activar \\\"validate-serializable-objects\\\" puede afectar al rendimiento\"}],\"affected\":[{\"source\":\"security@apache.org\",\"affectedData\":[{\"vendor\":\"Apache Software Foundation\",\"product\":\"Apache Geode\",\"platforms\":[\"Java 8 or 11\"],\"versions\":[{\"version\":\"Apache Geode\",\"lessThan\":\"1.15.0\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"security@apache.org\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-502\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-502\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:geode:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"1.15.0\",\"matchCriteriaId\":\"4C0E002C-C0BB-4B86-AF4B-28E90BBF667A\"}]}]}],\"references\":[{\"url\":\"https://lists.apache.org/thread/6js89pbqrp52zlpwgry5fsdn76gxbbfj\",\"source\":\"security@apache.org\",\"tags\":[\"Mailing List\",\"Vendor Advisory\"]},{\"url\":\"https://lists.apache.org/thread/6js89pbqrp52zlpwgry5fsdn76gxbbfj\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Vendor Advisory\"]}]}}",
    "redhat_vex": {
      "current_release_date": "2026-03-27T12:06:59+00:00",
      "cve": "CVE-2022-37023",
      "id": "CVE-2022-37023",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Apache Geode deserialization of untrusted data flaw when using REST API on Java 8 or Java 11",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-37023.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.