CVE-2024-45772

Summary

CVE-2024-45772 is a deserialization vulnerability affecting Apache Lucene's replicator module from versions 4.4.0 to 9.11.9. Specifically, the issue lies in the deprecated org.apache.lucene.replicator.http package. This flaw can be exploited if users deploy a network-accessible implementation and a corresponding client using an HTTP library that makes use of the API, such as a custom servlet and HTTPClient. To mitigate the issue on vulnerable versions, users can apply Java serialization filters like -Djdk.serialFilter='!*' on the command line without compromising functionality. However, the recommended solution is to upgrade to Apache Lucene version 9.12.0, which includes a fix for this vulnerability.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.