Lucene search

GoogleOSV:GHSA-8M84-H9HH-3CFH

HistoryAug 21, 2024 - 12:30 p.m.

Apache SeaTunnel SQL Injection vulnerability

2024-08-2112:30:25

Google

osv.dev

apache seatunnel

sql injection

mysql

security vulnerability

attackers

read files

mysql server

information

url

allowloadlocalinfile

allowurlinlocalinfile

allowloadlocalinfileinpath

maxallowedpacket

upgrade

version 1.0.1

software

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

6.8

Confidence

Low

EPSS

0.001

Percentile

34.8%

JSON

Mysql security vulnerability in Apache SeaTunnel.

Attackers can read files on the MySQL server by modifying the information in the MySQL URL

allowLoadLocalInfile=true&allowUrlInLocalInfile=true&allowLoadLocalInfileInPath=/&maxAllowedPacket=655360
This issue affects Apache SeaTunnel: 1.0.0.

Users are recommended to upgrade to version [1.0.1], which fixes the issue.

References

github.com/apache/seatunnel

lists.apache.org/thread/48j9f1nsn037mgzc4j9o51nwglb1s08h

nvd.nist.gov/vuln/detail/CVE-2023-49198

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

6.8

Confidence

Low

EPSS

0.001

Percentile

34.8%

JSON

Related for OSV:GHSA-8M84-H9HH-3CFH