CVE-2019-17556

Description

Apache Olingo versions 4.0.0 to 4.6.0 provide the AbstractService class, which is public API, uses ObjectInputStream and doesnt check classes being deserialized. If an attacker can feed malicious metadata to the class, then it may result in running attackers code in the worse case.

Risk Information

Base Score

9.8

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score

Exploitation Probability

0.782

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2019-17556 are fixed in Apache-odata-client-proxy 4.7.0	Windows
Vulnerabilities CVE-2019-17556 are fixed in Apache-odata-client-proxy for Linux 4.7.0	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234