Loading...
Skip to main content
GeekWala

CVE-2024-43383 — Vulnerability in Lucene.Net.Replicator — CVE Details

HIGH

Apache Lucene.Net.Replicator Deserialization of Untrusted Data vulnerability

Published October 31, 2024Updated February 11, 2025Source: osv

Summary

Deserialization of Untrusted Data vulnerability in Apache Lucene.Net.Replicator. This issue affects Apache Lucene.NET's Replicator library: from 4.8.0-beta00005 through 4.8.0-beta00016. An attacker that can intercept traffic between a replication client and server, or control the target replication node URL, can provide a specially-crafted JSON response that is deserialized as an attacker-provided exception type. This can result in remote code execution or other potential unauthorized access. Users are recommended to upgrade to version 4.8.0-beta00017, which fixes the issue.

Advisory Timeline

  • First published October 31, 2024 (711 days ago).
  • Last revised February 11, 2025 — 103 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

NuGet
Update Lucene.Net.Replicator to 4.8.0-beta00017 or later
dotnet add package Lucene.Net.Replicator --version 4.8.0-beta00017

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (1)

Affects 1 ecosystem: nuget (1).

PackageEcosystemAffectedFixed In
Lucene.Net.Replicator
nuget
4.8.0-beta00005, 4.8.0-beta00006, 4.8.0-beta00007, 4.8.0-beta00008 (+8 more)4.8.0-beta00017

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

  • CWE-502
    Deserialization of Untrusted DataMITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 8.0 score means for each attack dimension.

Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

Frequently Asked Questions

What is CVE-2024-43383?
Apache Lucene.Net.Replicator Deserialization of Untrusted Data vulnerability This vulnerability has been assigned a severity rating of HIGH (CVSS score: 8.0/10).
How do I check if my project is affected by CVE-2024-43383?
CVE-2024-43383 affects Lucene.Net.Replicator. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2024-43383 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
8.0

High exploitability or significant impact. Prioritize remediation within days.

Also Known As

GHSA-2qw8-ppr5-m96c

Related CVEs

More NuGet advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies