Apache Flume vulnerabilities

3 CVEs affecting Apache Flume, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-42468, published 2022-10-26.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2022-25167, published 2022-06-14. Critical severity, CVSS 9.8. EPSS: 5.2% chance of exploitation in the next 30 days. Apache Flume versions 1.4.0 through 1.9.0 are vulnerable to a remote code execution (RCE) attack when a configuration uses a JMS Source with a JNDI LDAP data source URI when an attacker has control…
CVE-2022-42468, published 2022-10-26. Critical severity, CVSS 9.8. EPSS: 3% chance of exploitation in the next 30 days. Apache Flume versions 1.4.0 through 1.10.1 are vulnerable to a remote code execution (RCE) attack when a configuration uses a JMS Source with an unsafe providerURL. This issue is fixed by limiting…
CVE-2022-34916, published 2022-08-21. Critical severity, CVSS 9.8. EPSS: 2.9% chance of exploitation in the next 30 days. Apache Flume versions 1.4.0 through 1.10.0 are vulnerable to a remote code execution (RCE) attack when a configuration uses a JMS Source with a JNDI LDAP data source URI when an attacker has control…