High severity · published Oct 3, 2024
CVE-2024-47561
Apache Avro Java SDK: Arbitrary Code Execution when reading Avro schema (Java SDK)
7.3
CVSS
3.3%
EPSS
No
On KEV
Description
Schema parsing in the Java SDK of Apache Avro 1.11.3 and previous versions allows bad actors to execute arbitrary code.
Users are recommended to upgrade to version 1.11.4 or 1.12.0, which fix this issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)3.3% · higher than 88% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AA
Apache Avro Java SDK · Apache Software Foundation
before 1.11.4 · source: vendor
AI
Active IQ Unified Manager · Netapp
All versions, or not specified · source: NVD
AV
Avro · Apache
before 1.11.4 · source: NVD, CISA
BS
Brocade San Navigator · Netapp
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-47561
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-47561
Mailing List
https://lists.apache.org/thread/c2v7mhqnmq0jmbwxqq3r5jbj1xg43h5x
Mailing List
http://www.openwall.com/lists/oss-security/2024/10/03/1
Third Party Advisory
https://security.netapp.com/advisory/ntap-20241011-0003/
More from Apache Avro Java SDK
7.3
CVE-2025-33042
Apache Avro Java SDK: Code injection on Java generated code