CVSS 4.0
9.2 criticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NCVE-2024-47561
Critical (9.2). EPSS 3.3% chance of exploitation in the next 30 days. Fixed in org.apache.avro:avro 1.11.4.
Schema parsing in the Java SDK of Apache Avro 1.11.3 and previous versions allows bad actors to execute arbitrary code.
Users are recommended to upgrade to version 1.11.4 or 1.12.0, which fix this issue.
Severity
CVSS 3.1
7.3 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L- EPSS
- 3.3% chance of exploitation in the next 30 days; higher than 88% of CVEs (scores of 2026-10-31)
- CWE
- CWE-502
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apache:avro
- netapp:active_iq_unified_manager
- netapp:brocade_san_navigator
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-r7pg-v2c8-mfg3 | Maven | org.apache.avro:avro | <1.11.4 | 1.11.4 |