CVE-2022-37021

Apache Geode versions up to 1.12.5, 1.13.4 and 1.14.0 are vulnerable to a deserialization of untrusted data flaw when using JMX over RMI on Java 8. Any user still on Java 8 who wishes to protect against deserialization attacks involving JMX or RMI should upgrade to Apache Geode 1.15 and Java 11. If upgrading to Java 11 is not possible, then upgrade to Apache Geode 1.15 and specify "--J=-Dgeode.enableGlobalSerialFilter=true" when starting any Locators or Servers. Follow the documentation for details on specifying any user classes that may be serialized/deserialized with the "serializable-object-filter" configuration option. Using a global serial filter will impact performance.

• CWE-502
• CWE-502

• https://lists.apache.org/thread/qrvhmytsshsk5xcb68pwccw3y6m8o8nrMailing List, Vendor Advisory
• https://lists.apache.org/thread/qrvhmytsshsk5xcb68pwccw3y6m8o8nrMailing List, Vendor Advisory

Published

Aug 31, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-37016Symantec Endpoint Protection (Windows) agent may be suscepti…9.8
• CVE-2022-37017Symantec Endpoint Protection (Windows) agent, prior to 14.3 …7.5
• CVE-2022-37018A potential vulnerability has been identified in the system …8.4
• CVE-2022-37019Potential vulnerabilities have been identified in the system…6.8
• CVE-2022-3702 A denial of service vulnerability was reported in Lenovo Va…7.1
• CVE-2022-37020Potential vulnerabilities have been identified in the system…6.8
• CVE-2022-37022Apache Geode versions up to 1.12.2 and 1.13.2 are vulnerable…8.8
• CVE-2022-37023Apache Geode versions prior to 1.15.0 are vulnerable to a de…6.5
• CVE-2022-37024Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, …8.8
• CVE-2022-37025An improper privilege management vulnerability in McAfee Sec…7.8
• CVE-2022-37026In Erlang/OTP before 23.3.4.15, 24.x before 24.3.4.2, and 25…9.8
• CVE-2022-37027Ahsay AhsayCBS 9.1.4.0 allows an authenticated system user t…7.2