PT-2023-7201 · Apache · Apache Submarine

Lengjingqicai · Publicado 2023-11-22 · Atualizado 2023-11-30 · CVE-2023-37924

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Submarine versions 0.7.0 through 0.7.x

Description The issue is related to an SQL injection vulnerability in Apache Submarine when a user logs in, potentially allowing a remote attacker to execute arbitrary SQL queries, resulting in unauthorized login.

Recommendations For Apache Submarine versions 0.7.0 through 0.7.x, upgrade to version 0.8.0 to fix the issue and support the oidc authentication mode, which removes the case of unauthenticated logins. If using a version lower than 0.8.0 and not wanting to upgrade, try cherry-picking PR and rebuild the submarine-server image to fix this.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

BDU:2023-08228

CVE-2023-37924

GHSA-V5GJ-FX3G-HCPW

PYSEC-2023-244

Produtos afetados

Apache Submarine

Referências · 14

• https://github.com/apache/submarine/pull/1037 · Correção
• https://github.com/apache/submarine · Nota
• https://github.com/apache/submarine/commit/4cd2af10499ac6dc4f82bda179d9f414a522abef · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/apache-submarine/PYSEC-2023-244.yaml · Nota
• https://securityonline.info/cve-2023-37924-apache-submarine-sql-injection-vulnerability · Nota
• https://issues.apache.org/jira/browse/SUBMARINE-1361 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-37924 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-37924 · Aviso do Fabricante
• https://osv.dev/vulnerability/PYSEC-2023-244 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-v5gj-fx3g-hcpw · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2023-08228 · Nota de Segurança
• https://t.me/pentestingnews/41312 · Publicação no Telegram
• https://lists.apache.org/thread/g99h773vd49n1wyghdq1llv2f83w1b3r · Aviso do Fabricante
• https://vuldb.com/ru/?id.245960 · Nota