Vulnerability-Lookup

CNVD-2025-09241

Vulnerability from cnvd - Published: 2025-05-07

Title

Apache Seata代码问题漏洞

Description

Apache Seata是美国阿帕奇（Apache）基金会的一款在微服务架构下提供高性能和简单易用的分布式事务服务的开源项目。 Apache Seata存在代码问题漏洞，该漏洞源于反序列化不受信任的数据。攻击者可利用该漏洞在受害者的系统上执行任意代码。

Severity

高

Formal description

厂商尚未发布漏洞修复程序，请及时关注更新： http://www.openwall.com/lists/oss-security/2025/03/19/5

Reference

https://nvd.nist.gov/vuln/detail/CVE-2024-47552

Impacted products

Name
Apache Seata >=2.0.0，<2.2.0

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2024-47552",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-47552"
    }
  },
  "description": "Apache Seata\u662f\u7f8e\u56fd\u963f\u5e15\u5947\uff08Apache\uff09\u57fa\u91d1\u4f1a\u7684\u4e00\u6b3e\u5728\u5fae\u670d\u52a1\u67b6\u6784\u4e0b\u63d0\u4f9b\u9ad8\u6027\u80fd\u548c\u7b80\u5355\u6613\u7528\u7684\u5206\u5e03\u5f0f\u4e8b\u52a1\u670d\u52a1\u7684\u5f00\u6e90\u9879\u76ee\u3002\n\nApache Seata\u5b58\u5728\u4ee3\u7801\u95ee\u9898\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u53cd\u5e8f\u5217\u5316\u4e0d\u53d7\u4fe1\u4efb\u7684\u6570\u636e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5728\u53d7\u5bb3\u8005\u7684\u7cfb\u7edf\u4e0a\u6267\u884c\u4efb\u610f\u4ee3\u7801\u3002",
  "formalWay": "\u5382\u5546\u5c1a\u672a\u53d1\u5e03\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttp://www.openwall.com/lists/oss-security/2025/03/19/5",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2025-09241",
  "openTime": "2025-05-07",
  "products": {
    "product": "Apache Seata \u003e=2.0.0\uff0c\u003c2.2.0"
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2024-47552",
  "serverity": "\u9ad8",
  "submitTime": "2025-04-08",
  "title": "Apache Seata\u4ee3\u7801\u95ee\u9898\u6f0f\u6d1e"
}

CVE-2024-47552 (GCVE-0-2024-47552)

Vulnerability from cvelistv5 – Published: 2025-03-20 08:58 – Updated: 2026-03-30 08:35

Title

Apache Seata (incubating): Deserialization of untrusted Data in jraft mode in Apache Seata Server

Summary

Deserialization of Untrusted Data vulnerability in Apache Seata (incubating). This issue affects Apache Seata (incubating): from 2.0.0 before 2.2.0. Severity Justification: The Apache Seata security team assesses the severity of this vulnerability as "Low" due to stringent real-world mitigating factors. First, the vulnerability is strictly isolated to the Raft cluster mode, an optional and non-default feature introduced in v2.0.0, while most users rely on the unaffected traditional architecture. Second, Seata is an internal middleware; communication between TC and RM/TM occurs entirely within trusted internal networks. An attacker would require prior, unauthorized access to the Intranet to exploit this, making external exploitation highly improbable. Users are recommended to upgrade to version 2.2.0, which fixes the issue.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-03-24 14:45 UTC

CWE

CWE-502 - Deserialization of Untrusted Data

Assigner

apache mitre root

References

3 references

URL	Tags
https://lists.apache.org/thread/652o82vzk9qrtgksk…	vendor-advisory
https://github.com/apache/incubator-seata/commit/…	patch
http://www.openwall.com/lists/oss-security/2025/03/19/5

Impacted products

1 product

Vendor	Product	Version
Apache Software Foundation	Apache Seata (incubating)	Affected: 2.0.0 , < 2.2.0 (semver)

Credits

liuhuajin<liuhuajin1@huawei.com> llqxc369@gmail.com

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-03-20T09:03:43.843Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2025/03/19/5"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-47552",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-24T14:45:04.375793Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-24T14:45:20.117Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected",
          "packageName": "org.apache.seata:seata-server",
          "product": "Apache Seata (incubating)",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "2.2.0",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "liuhuajin\u003cliuhuajin1@huawei.com\u003e"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "llqxc369@gmail.com"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003eDeserialization of Untrusted Data vulnerability in Apache Seata (incubating).\u003c/div\u003e\u003cdiv\u003e\n\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003eThis issue affects Apache Seata (incubating): from 2.0.0 before 2.2.0.\u003c/div\u003e\u003cdiv\u003e\n\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003cb\u003eSeverity Justification:\u003c/b\u003e\u003c/div\u003e\u003cdiv\u003eThe Apache Seata security team assesses the severity of this vulnerability as \"Low\" due to stringent real-world mitigating factors. First, the vulnerability is strictly isolated to the Raft cluster mode, an optional and non-default feature introduced in v2.0.0, while most users rely on the unaffected traditional architecture. Second, Seata is an internal middleware; communication between TC and RM/TM occurs entirely within trusted internal networks. An attacker would require prior, unauthorized access to the Intranet to exploit this, making external exploitation highly improbable.\u003c/div\u003e\u003cdiv\u003e\n\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003eUsers are recommended to upgrade to version 2.2.0, which fixes the issue.\u003c/div\u003e\u003cbr\u003e"
            }
          ],
          "value": "Deserialization of Untrusted Data vulnerability in Apache Seata (incubating).\n\n\n\n\n\nThis issue affects Apache Seata (incubating): from 2.0.0 before 2.2.0.\n\n\n\n\n\nSeverity Justification:\n\nThe Apache Seata security team assesses the severity of this vulnerability as \"Low\" due to stringent real-world mitigating factors. First, the vulnerability is strictly isolated to the Raft cluster mode, an optional and non-default feature introduced in v2.0.0, while most users rely on the unaffected traditional architecture. Second, Seata is an internal middleware; communication between TC and RM/TM occurs entirely within trusted internal networks. An attacker would require prior, unauthorized access to the Intranet to exploit this, making external exploitation highly improbable.\n\n\n\n\n\nUsers are recommended to upgrade to version 2.2.0, which fixes the issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "low"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "CWE-502 Deserialization of Untrusted Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-30T08:35:40.674Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/652o82vzk9qrtgksk55cfgpbvdgtkch0"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/apache/incubator-seata/commit/20cd9625d23f99b71fefc83b8db96c14092a9950"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Apache Seata (incubating): Deserialization of untrusted Data in jraft mode in Apache Seata Server",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2024-47552",
    "datePublished": "2025-03-20T08:58:01.495Z",
    "dateReserved": "2024-09-26T12:19:33.596Z",
    "dateUpdated": "2026-03-30T08:35:40.674Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CNVD-2025-09241

CVE-2024-47552 (GCVE-0-2024-47552)

Tags

Sightings

Nomenclature

Related by attack behaviour