Missing authorization in Apache Ignite
Priority MEDIUM 47CWE-862Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-862.
Summary
Apache Ignite uses H2 database to build SQL distributed execution engine. H2 provides SQL functions which could be used by attacker to access to a filesystem.
Why it matters now
EPSS 0.04983 92nd percentileScored 2026-11-07
Fix Fixed org.apache.ignite:ignite-core (Maven): 2.8.1
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Apache Ignite | All versions of Apache Ignite up to 2.8 | — | No fix listed | CNA |
| — | org.apache.ignite:ignite-core (Maven) | before 2.8.1 | 2.8.1 | Patch available | GHSA-5wm5-8q42-rhxg |
- Apache Ignite Vendor— Affected All versions of Apache Ignite up to 2.8 Fixed in — No fix listed CNA
- org.apache.ignite:ignite-core (Maven) Vendor— Affected before 2.8.1 Fixed in 2.8.1 Patch available GHSA-5wm5-8q42-rhxg
Remediation
- Fix · GHSA-5wm5-8q42-rhxg org.apache.ignite:ignite-core (Maven) Fixed in 2.8.1 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
Not affected: 2 products
- Red Hat Fuse 7
- Red Hat JBoss Fuse 6
Timeline
- 2026-10-02 Threatist record created from CVE-2020-1963
- 2026-10-03 Alias added: GHSA-5wm5-8q42-rhxg
References
Advisory 4
- [oss-security] 20200603 [CVE-2020-1963] Apache Ignite access to file system disclosure vulnerability
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://lists.apache.org/thread.html/r1933faf8a26c431f38a5f8dbbfab80254454e54e33a79be474b67dc4%40%3Cdev.ignite.apache.org%3E
- https://nvd.nist.gov/vuln/detail/CVE-2020-1963
Other 14
- [ignite-user] 20200603 RE: [CVE-2020-1963] Apache Ignite access to file system disclosure vulnerability
- [ignite-dev] 20200603 RE: [CVE-2020-1963] Apache Ignite access to file system disclosure vulnerability
- [ignite-dev] 20200605 Re: [CVE-2020-1963] Apache Ignite access to file system disclosure vulnerability
- [ignite-dev] 20200608 Re: [CVE-2020-1963] Apache Ignite access to file system disclosure vulnerability
- [ignite-user] 20200609 Re: [CVE-2020-1963] Apache Ignite access to file system disclosure vulnerability
- [ignite-dev] 20200615 Re: [CVE-2020-1963] Apache Ignite access to file system disclosure vulnerability
- [ignite-user] 20200615 Re: [CVE-2020-1963] Apache Ignite access to file system disclosure vulnerability
- https://lists.apache.org/thread.html/r119024ef71c8d39f952df0950a275d09714715179aff544aea0129a3@%3Cuser.ignite.apache.org%3E
- https://lists.apache.org/thread.html/rd43ae18588fd7bdb375be63bc95a651aab319ced6306759e1237ce67@%3Cdev.ignite.apache.org%3E
- https://lists.apache.org/thread.html/rdf37011b92a31a67c299ff45655e2638f194fc814e5c6e2fde352884@%3Cdev.ignite.apache.org%3E
- https://lists.apache.org/thread.html/rdf37011b92a31a67c299ff45655e2638f194fc814e5c6e2fde352884@%3Cuser.ignite.apache.org%3E
- https://lists.apache.org/thread.html/re7b43cf8333ee30b6589e465f72a6ed4a082222612d1a0fdd30beb94@%3Cdev.ignite.apache.org%3E
- https://lists.apache.org/thread.html/re7b43cf8333ee30b6589e465f72a6ed4a082222612d1a0fdd30beb94@%3Cuser.ignite.apache.org%3E
- https://lists.apache.org/thread.html/rf032a13a4711f88c0a2c0734eecbee1026cc1b6cde27d16a653f8755@%3Cdev.ignite.apache.org%3E
More Apache Ignite vulnerabilities
- TI-2018-01178 Code injection in Spring Framework KEVCVSS 3.1CRITICAL 9.8
- TI-2024-35239 Apache Ignite: Possible RCE when deserializing incoming messages by the server node CVSS 4.0CRITICAL 9.5
- TI-2018-05795 Deserialization of untrusted data in Apache Ignite CVSS 3.0CRITICAL 9.8
- TI-2018-01199 Deserialization of untrusted data in Apache Ignite CVSS 3.0CRITICAL 9.8
- TI-2025-31105 Apache Ignite: REST HTTP arbitrary file read vulnerability CVSS 4.0HIGH 8.5
- TI-2017-05322 Information disclosure in Apache Ignite CVSS 3.0HIGH 7.5
Sources
- CVE-2020-1963 · CVE Program
- CVE-2020-1963 · NVD
- FIRST EPSS
- GHSA-5wm5-8q42-rhxg · GitHub Advisory Database · CC BY 4.0
- CVE-2020-1963 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences