{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-06-04T17:24:38.108","vulnerabilities":[{"cve":{"id":"CVE-2018-8018","sourceIdentifier":"security@apache.org","published":"2018-07-20T01:29:04.833","lastModified":"2024-11-21T04:13:06.377","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"In Apache Ignite before 2.4.8 and 2.5.x before 2.5.3, the serialization mechanism does not have a list of classes allowed for serialization/deserialization, which makes it possible to run arbitrary code when 3-rd party vulnerable classes are present in Ignite classpath. The vulnerability can be exploited if the one sends a specially prepared form of a serialized object to GridClientJdkMarshaller deserialization endpoint."},{"lang":"es","value":"En Apache Ignite versión anterior a 2.4.8 y versión 2.5. x versión anterior a 2.5.3, el mecanismo de serialización no tiene una lista de clases permitidas para la serialización/deserialización, lo que hace posible ejecutar código arbitrario cuando las clases vulnerables de un tercero están presentes en Ignite Classpath. La vulnerabilidad se puede se puede explotar si el envía un formulario especialmente preparado de un objeto serializado hacia el endpoint de conexión de deserialización GridClientJdkMarshaller."}],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":true,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-502"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:apache:ignite:*:*:*:*:*:*:*:*","versionEndExcluding":"2.4.8","matchCriteriaId":"947F0F40-A9B2-4EF8-8C81-3ABB9F338A50"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:ignite:*:*:*:*:*:*:*:*","versionStartExcluding":"2.5.0","versionEndExcluding":"2.5.3","matchCriteriaId":"B679E033-F70E-4B00-8BEF-43DDD23D380D"}]}]}],"references":[{"url":"http://www.securityfocus.com/bid/104911","source":"security@apache.org","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://access.redhat.com/errata/RHSA-2018:3768","source":"security@apache.org","tags":["Third Party Advisory"]},{"url":"https://lists.apache.org/thread.html/e0fdf53114a321142ecfa5cfa17658090f0b4e1677de431e329b37ab%40%3Cdev.ignite.apache.org%3E","source":"security@apache.org"},{"url":"http://www.securityfocus.com/bid/104911","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://access.redhat.com/errata/RHSA-2018:3768","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://lists.apache.org/thread.html/e0fdf53114a321142ecfa5cfa17658090f0b4e1677de431e329b37ab%40%3Cdev.ignite.apache.org%3E","source":"af854a3a-2127-422b-91ae-364da2661108"}]}}]}