Executive brief
Apache serialization mechanism does not have a list of classes allowed for serialization/deserialization
Affected products
- Maven org.apache.ignite:ignite-core
Junglewise Threat Intelligence
CVE-2018-1295: Apache serialization mechanism does not have a list of classes allowed for serialization/deserialization
CVE-2018-1295 · Severity: low · CVSS 3 · Published 2018-10-16
Technologies: org.apache.ignite:ignite-core (Maven). Vendors: Maven.
Related threats
- Apache Ignite path traversal in REST API
- Apache Ignite: Possible RCE when deserializing incoming messages by the server node
- File system access via H2 in Apache Ignite
- Code execution via deserialization in org.apache.ignite:ignite-core
- Moderate severity vulnerability that affects org.apache.ignite:ignite-core