CVE-2019-17556
Last modified
CVE-2019-17556 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. Apache Olingo versions 4.0.0 to 4.6.0 provide the AbstractService class, which is public API, uses ObjectInputStream and doesn't check classes being deserialized. If an attacker can feed malicious metadata to the class, then it may result in running attacker's code in the worse case.. EPSS estimates a 3.62% chance of exploitation in the next 30 days.
Description
Apache Olingo versions 4.0.0 to 4.6.0 provide the AbstractService class, which is public API, uses ObjectInputStream and doesn't check classes being deserialized. If an attacker can feed malicious metadata to the class, then it may result in running attacker's code in the worse case.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Apache | Olingo | >= 4.0.0, <= 4.6.0 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2019-17556?
How severe is CVE-2019-17556?
How do I fix CVE-2019-17556?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2019
- CVE-2019-17550The Blog2Social plugin before 5.9.0 for WordPress is affecte…6.1
- CVE-2019-17551In Apak Wholesale Floorplanning Finance 6.31.8.3 and 6.31.8.…6.1
- CVE-2019-17552An issue was discovered in idreamsoft iCMS v7.0.14. There is…9.8
- CVE-2019-17553An issue was discovered in MetInfo v7.0.0 beta. There is SQL…9.8
- CVE-2019-17554The XML content type entity deserializer in Apache Olingo ve…5.5
- CVE-2019-17555The AsyncResponseWrapperImpl class in Apache Olingo versions…7.5
- CVE-2019-17557It was found that the Apache Syncope EndUser UI login page p…5.4
- CVE-2019-17558Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a R…7.5
- CVE-2019-17559There is a vulnerability in Apache Traffic Server 6.0.0 to 6…9.8
- CVE-2019-1756A vulnerability in Cisco IOS XE Software could allow an auth…7.2
- CVE-2019-17560The "Apache NetBeans" autoupdate system does not validate SS…9.1
- CVE-2019-17561The "Apache NetBeans" autoupdate system does not fully valid…7.5
Are you affected by CVE-2019-17556?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST