PT-2023-14756 · Apache · Apache Streampark

Huajie Wang · Publicado 2023-05-01 · Atualizado 2024-10-21 · CVE-2022-45802

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache StreamPark versions prior to 2.0.0

Description The issue allows any user to upload a jar as an application without mandatory verification of the uploaded file type. This enables users to upload high-risk files and potentially upload them to any directory.

Recommendations For versions prior to 2.0.0, upgrade to Apache StreamPark 2.0.0 or later. As a temporary workaround, consider restricting the upload functionality to prevent users from uploading high-risk files until the issue is resolved.

Correção

Path traversal

Unrestricted File Upload

Enumeração de Fraquezas

CWE-22

CWE-434

Identificadores relacionados

CVE-2022-45802

GHSA-6874-289G-F7H7

Produtos afetados

Apache Streampark

Referências · 9

• https://github.com/apache/incubator-streampark · Nota
• https://github.com/apache/incubator-streampark/commit/0c87c6d8cf39ef2c31c1dea1a7df23d76f5e1236 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2022-45802 · Nota de Segurança
• https://t.me/cvenotify/98961 · Publicação no Telegram
• https://lists.apache.org/thread/thwl1v2h6r3c21x1qwff08o57qzjnst6 · Aviso do Fabricante
• https://t.me/cvenotify/49502 · Publicação no Telegram
• https://osv.dev/vulnerability/GHSA-6874-289g-f7h7 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2022-45802 · Aviso do Fabricante
• https://t.me/cvenotify/49553 · Publicação no Telegram