PT-2024-26941 · Apache · Apache Submarine Server Core

L0Ne1Y · Published 2024-06-12 · Updated 2024-09-26 · CVE-2024-36265

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Submarine Server Core versions 0.8.0 and later

Description The issue is related to an Incorrect Authorization vulnerability in Apache Submarine Server Core. This vulnerability only affects products that are no longer supported by the maintainer. Users are recommended to find an alternative or restrict access to the instance to trusted users.

Recommendations As a temporary workaround, consider restricting access to the instance to trusted users until an alternative solution is found. Find an alternative to Apache Submarine Server Core, as the project is retired and no fix will be released.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2024-36265

GHSA-6Q97-8V3G-RPXW

PYSEC-2024-98

Affected Products

Apache Submarine Server Core

References · 10

• https://osv.dev/vulnerability/PYSEC-2024-98 · Vendor Advisory
• https://lists.apache.org/thread/prckhhst19qxof064hsm8cccxtofvflz · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-36265 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-36265 · Security Note
• https://osv.dev/vulnerability/GHSA-6q97-8v3g-rpxw · Vendor Advisory
• https://github.com/apache/submarine · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/apache-submarine/PYSEC-2024-98.yaml · Note
• https://t.me/cvenotify/88442 · Telegram Post
• http://openwall.com/lists/oss-security/2024/06/12/3 · Note
• https://t.me/cvenotify/83022 · Telegram Post