Lucene search

GitHub Advisory DatabaseGHSA-8M84-H9HH-3CFH

HistoryAug 21, 2024 - 12:30 p.m.

Apache SeaTunnel SQL Injection vulnerability

2024-08-2112:30:25

CWE-552

GitHub Advisory Database

github.com

apache seatunnel

sql injection

mysql

security

vulnerability

attackers

read files

mysql server

modify information

url

upgrade

1.0.1

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

6.5

Confidence

High

EPSS

0.001

Percentile

34.8%

JSON

Mysql security vulnerability in Apache SeaTunnel.

Attackers can read files on the MySQL server by modifying the information in the MySQL URL

allowLoadLocalInfile=true&allowUrlInLocalInfile=true&allowLoadLocalInfileInPath=/&maxAllowedPacket=655360
This issue affects Apache SeaTunnel: 1.0.0.

Users are recommended to upgrade to version [1.0.1], which fixes the issue.

Affected configurations

Vulners

Node

org.apache.seatunnel\Matchseatunnel1.0.0

VendorProductVersionCPE
*org.apache.seatunnel\seatunnelcpe:2.3:a:*:org.apache.seatunnel\:seatunnel:1.0.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
*	org.apache.seatunnel\	seatunnel	cpe:2.3:a::org.apache.seatunnel\:seatunnel:1.0.0:::::::

References

github.com/advisories/GHSA-8m84-h9hh-3cfh

lists.apache.org/thread/48j9f1nsn037mgzc4j9o51nwglb1s08h

nvd.nist.gov/vuln/detail/CVE-2023-49198

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

6.5

Confidence

High

EPSS

0.001

Percentile

34.8%

JSON

Related for GHSA-8M84-H9HH-3CFH