CVE-2022-37022

Apache Geode versions up to 1.12.2 and 1.13.2 are vulnerable to a deserialization of untrusted data flaw when using JMX over RMI on Java 11. Any user wishing to protect against deserialization attacks involving JMX or RMI should upgrade to Apache Geode 1.15. Use of 1.15 on Java 11 will automatically protect JMX over RMI against deserialization attacks. This should have no impact on performance since it only affects JMX/RMI which Gfsh uses to communicate with the JMX Manager which is hosted on a Locator.

• CWE-502
• CWE-502

• https://lists.apache.org/thread/kr1y4l9752g1ww1shnmh8dbfjq785k4mMailing List, Vendor Advisory
• https://lists.apache.org/thread/kr1y4l9752g1ww1shnmh8dbfjq785k4mMailing List, Vendor Advisory

Published

Aug 31, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-37017Symantec Endpoint Protection (Windows) agent, prior to 14.3 …7.5
• CVE-2022-37018A potential vulnerability has been identified in the system …8.4
• CVE-2022-37019Potential vulnerabilities have been identified in the system…6.8
• CVE-2022-3702 A denial of service vulnerability was reported in Lenovo Va…7.1
• CVE-2022-37020Potential vulnerabilities have been identified in the system…6.8
• CVE-2022-37021Apache Geode versions up to 1.12.5, 1.13.4 and 1.14.0 are vu…9.8
• CVE-2022-37023Apache Geode versions prior to 1.15.0 are vulnerable to a de…6.5
• CVE-2022-37024Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, …8.8
• CVE-2022-37025An improper privilege management vulnerability in McAfee Sec…7.8
• CVE-2022-37026In Erlang/OTP before 23.3.4.15, 24.x before 24.3.4.2, and 25…9.8
• CVE-2022-37027Ahsay AhsayCBS 9.1.4.0 allows an authenticated system user t…7.2
• CVE-2022-37028ISAMS 22.2.3.2 is prone to stored Cross-site Scripting (XSS)…5.4