CVE-2022-25167
Published: 14 June 2022
Summary
CVE-2022-25167 is a critical-severity Improper Input Validation (CWE-20) vulnerability in Apache Flume. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 9.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
Apache Flume versions 1.4.0 through 1.9.0 contain a remote code execution vulnerability in the JMS Source component when a configuration specifies a JNDI LDAP data source URI. The flaw arises because the software does not restrict the protocols that can be supplied through JNDI, allowing an attacker who controls the referenced LDAP server to supply a malicious binding. The issue is tracked under CWE-20 and CWE-74 and carries a CVSS 3.1 score of 9.8.
An unauthenticated attacker with the ability to influence or compromise the target LDAP server can trigger the vulnerability over the network, resulting in arbitrary code execution on the Flume agent with no user interaction required. Successful exploitation grants full confidentiality, integrity, and availability impact on the affected system.
Public advisories and the associated Apache JIRA issue FLUME-3416 state that the fix limits JNDI lookups to the java protocol or to no protocol at all. The change is documented in the OSS-Security mailing list postings from June 2022 and in the Apache Flume project updates.
EPSS for this CVE rose from lower values to a peak of 0.1155 on 2025-12-11 before receding to the current score of 0.0529, indicating a period of increased exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-6182
Vulnerability details
Apache Flume versions 1.4.0 through 1.9.0 are vulnerable to a remote code execution (RCE) attack when a configuration uses a JMS Source with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This…
more
issue is fixed by limiting JNDI to allow only the use of the java protocol or no protocol.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Security testing and evaluation at multiple SDLC stages directly detects missing or flawed input validation, with the required remediation process ensuring fixes are applied.
Security testing and developer training directly verify and enforce proper input validation, reducing exploitability of injection and malformed-data weaknesses.
Directly implements checks on information inputs to reject invalid data before processing.
Identifies indicators of injection attacks (command, SQL, LDAP, etc.) via anomaly and attack monitoring.
Spam protection mechanisms perform filtering and detection on inbound/outbound messages, directly compensating for missing or weak input validation of unsolicited content.