CyberRota Analysis
This is a critical severity vulnerability with a CVSS score of 9.8. It affects Apache.
CVE
CVE-2019-17556
Severity
CRITICAL
CVSS
9.8
EPSS
3.62%
Apache
Original NVD Description
Apache Olingo versions 4.0.0 to 4.6.0 provide the AbstractService class, which is public API, uses ObjectInputStream and doesn't check classes being deserialized. If an attacker can feed malicious metadata to the class, then it may result in running attacker's code in the worse case.
Related CVEs
Other vulnerabilities affecting the same vendor(s)