PT-2025-11949 · Apache · Apache Seata

Liuhuajin + 1 · Published 2025-03-19 · Updated 2025-07-02 · CVE-2024-47552

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache Seata (incubating) versions 2.0.0 through 2.1.x

Description The issue is related to the deserialization of untrusted data, which can lead to remote code execution. This issue affects Apache Seata (incubating) from version 2.0.0 before 2.2.0. Users are recommended to upgrade to version 2.2.0 to fix the issue.

Recommendations For Apache Seata (incubating) versions 2.0.0 through 2.1.x, upgrade to version 2.2.0 to resolve the issue.

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2025-04021

CVE-2024-47552

GHSA-2R4X-667F-MPFH

GHSA-M964-FJRH-XXQ2

Affected Products

Apache Seata

References · 26

• https://github.com/apache/incubator-seata/commit/20cd9625d23f99b71fefc83b8db96c14092a9950 · Patch
• https://osv.dev/vulnerability/CVE-2024-47552 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-32897 · Security Note
• https://lists.apache.org/thread/652o82vzk9qrtgksk55cfgpbvdgtkch0 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2r4x-667f-mpfh · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-m964-fjrh-xxq2 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-04021 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-47552 · Security Note
• https://cve.org/CVERecord?id=CVE-2024-47552 · Security Note
• https://github.com/apache/incubator-seata · Note
• https://github.com/apache/incubator-seata/commit/7eda23e948312ed52c3336de70a11f4d2ab06a48 · Note
• https://github.com/apache/incubator-seata/releases/tag/v2.2.0 · Note
• https://github.com/apache/incubator-seata/commit/c0d2ac540b5579e909ae3240f112575313fcad34 · Note
• https://twitter.com/CVEnew/status/1902650308389421392 · Twitter Post
• https://lists.apache.org/thread/9fhtf7yvpjpzlwd1m0wfgg6tp2btxpy1 · Note