{"id":"CVE-2022-42468","aliases":["EUVD-2022-7069","GHSA-9w4g-fp9h-3q2v"],"status":"published","title":"Apache Flume prior to 1.11.0 has an Improper Input Validation (JNDI Injection) in JMSSource","description":"Apache Flume versions 1.4.0 through 1.10.1 are vulnerable to a remote code execution (RCE) attack when a configuration uses a JMS Source with an unsafe providerURL. This issue is fixed by limiting JNDI to allow only the use of the java protocol or no protocol.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.03722,"percentile":0.89888,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20","CWE-502","CWE-74"],"published":"2022-10-26T00:00:00Z","modified":"2026-06-17T05:04:58Z","fixes":[{"ecosystem":"Maven","package":"org.apache.flume.flume-ng-sources:flume-jms-source","fixed_in":["1.11.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.flume.flume-ng-sources:flume-jms-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.apache.flume.flume-ng-sources:flume-jms-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0"}]}],"versions":["1.10.0","1.10.1","1.4.0","1.5.0","1.5.0.1","1.5.1","1.5.2","1.6.0","1.7.0","1.8.0","1.9.0"]}],"products":[{"vendor":"apache","product":"flume"},{"vendor":"apache software foundation","product":"apache flume"}],"references":[{"url":"https://issues.apache.org/jira/browse/FLUME-3437","tags":["x_transferred","Issue Tracking","Vendor Advisory","web"]},{"url":"https://lists.apache.org/thread/939wkx8o90bp6m2ht3t1sdyo1ncypl78","tags":["x_transferred","Mailing List","Patch","Vendor Advisory","web"]},{"url":"https://lists.apache.org/thread/1ckhmp539zr2nd2rs45pocpywk2d9zvz","tags":["x_transferred","Mailing List","Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-42468","tags":["advisory"]},{"url":"https://github.com/apache/flume/commit/eee179a09df405c1ab55ae25a53b76ca1050bb97","tags":["web"]},{"url":"https://github.com/advisories/GHSA-9w4g-fp9h-3q2v"},{"url":"https://github.com/apache/flume","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2022-42468","title":"Apache Flume prior to 1.11.0 has an Improper Input Validation (JNDI Injection) in JMSSource","description":"Apache Flume versions 1.4.0 through 1.10.1 are vulnerable to a remote code execution (RCE) attack when a configuration uses a JMS Source with an unsafe providerURL. This issue is fixed by limiting JNDI to allow only the use of the java protocol or no protocol.","status":"published","published":"2022-10-26T00:00:00Z","modified":"2025-05-07T13:53:00.467Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-20","CWE-74"],"updated_at":"2026-11-02T14:34:27.640972Z"}],"euvd":[{"id":"EUVD-2022-7069","description":"Apache Flume versions 1.4.0 through 1.10.1 are vulnerable to a remote code execution (RCE) attack when a configuration uses a JMS Source with an unsafe providerURL. This issue is fixed by limiting JNDI to allow only the use of the java protocol or no protocol.","status":"published","published":"2022-10-26T00:00:00Z","modified":"2025-05-07T13:53:00Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T20:32:53.482549Z"}],"ghsa":[{"id":"GHSA-9w4g-fp9h-3q2v","title":"Apache Flume vulnerable to remote code execution via deserialization of unsafe providerURL","description":"Flume’s JMSSource class can be configured with a providerUrl parameter. A JNDI lookup is performed on this name without performing validation. This could result in untrusted data being deserialized, leading to remote code execution (RCE) attack when a configuration uses a JMS Source with an unsafe providerURL. This issue is fixed in version 1.11.0.","status":"published","published":"2022-10-26T19:00:38Z","modified":"2023-07-28T20:31:00Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-20","CWE-502"],"updated_at":"2026-11-02T14:36:58.760727Z"}],"nvd":[{"id":"CVE-2022-42468","description":"Apache Flume versions 1.4.0 through 1.10.1 are vulnerable to a remote code execution (RCE) attack when a configuration uses a JMS Source with an unsafe providerURL. This issue is fixed by limiting JNDI to allow only the use of the java protocol or no protocol.","status":"published","published":"2022-10-26T16:15:11.823Z","modified":"2026-06-17T05:04:58.77Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-20","CWE-74"],"updated_at":"2026-11-02T14:07:31.127985Z"}],"osv":[{"id":"GHSA-9w4g-fp9h-3q2v","title":"Apache Flume vulnerable to remote code execution via deserialization of unsafe providerURL","description":"Flume’s JMSSource class can be configured with a providerUrl parameter. A JNDI lookup is performed on this name without performing validation. This could result in untrusted data being deserialized, leading to remote code execution (RCE) attack when a configuration uses a JMS Source with an unsafe providerURL. This issue is fixed in version 1.11.0.","status":"published","published":"2022-10-26T19:00:38Z","modified":"2024-02-16T08:16:33.43999Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-20","CWE-502"],"updated_at":"2026-11-02T15:46:44.225359Z"}]}}