CVE-2024-28253

🗓️ 15 Mar 2024 19:55:39Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 117 Views🌐 WEB

OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team collaboration. CVE-2024-28253, Remote Code Execution, fixed in v1.3.1

Reporter	Title	Published	Views	Family All 15
Circl	CVE-2024-28253	15 Mar 202406:12	–	circl
CNNVD	OpenMetadata Security Vulnerabilities	15 Mar 202400:00	–	cnnvd
Cvelist	CVE-2024-28253 SpEL Injection in `PUT /api/v1/policies` in OpenMetadata	15 Mar 202419:55	–	cvelist
Github Security Blog	OpenMetadata vulnerable to SpEL Injection in `PUT /api/v1/policies` (`GHSL-2023-252`)	23 Apr 202421:11	–	github
Nuclei	OpenMetaData - SpEL Injection in PUT /api/v1/policies	1 Jun 202605:38	–	nuclei
NVD	CVE-2024-28253	15 Mar 202420:15	–	nvd
OSV	CVE-2024-28253 SpEL Injection in `PUT /api/v1/policies` in OpenMetadata	15 Mar 202419:55	–	osv
OSV	GHSA-7VF4-X5M2-R6GR OpenMetadata vulnerable to SpEL Injection in `PUT /api/v1/policies` (`GHSL-2023-252`)	23 Apr 202421:11	–	osv
Positive Technologies	PT-2024-2592	15 Mar 202400:00	–	ptsecurity
RedhatCVE	CVE-2024-28253	5 Feb 202500:59	–	redhatcve

NVD

Vulners

Vulnrichment

Node

open-metadata openmetadataRange<1.3.1

[
  {
    "vendor": "open-metadata",
    "product": "OpenMetadata",
    "versions": [
      {
        "version": "< 1.3.1",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/open-metadata/OpenMetadata/blob/main/openmetadata-service/src/main/java/org/openmetadata/service/jdbi3/PolicyRepository.java
github	www.github.com/open-metadata/OpenMetadata/blob/b6b337e09a05101506a5faba4b45d370cc3c9fc8/openmetadata-service/src/main/java/org/openmetadata/service/jdbi3/EntityRepository.java
github	www.github.com/open-metadata/OpenMetadata/security/advisories/GHSA-7vf4-x5m2-r6gr
github	www.github.com/open-metadata/OpenMetadata/blob/b6b337e09a05101506a5faba4b45d370cc3c9fc8/openmetadata-service/src/main/java/org/openmetadata/service/resources/EntityResource.java
github	www.github.com/open-metadata/OpenMetadata/blob/b6b337e09a05101506a5faba4b45d370cc3c9fc8/openmetadata-service/src/main/java/org/openmetadata/service/resources/policies/PolicyResource.java
codeql	www.codeql.github.com/codeql-query-help/java/java-spel-expression-injection

Parameter	Position	Path	Description	CWE
body	request body	/api/v1/policies	SpEL injection vulnerability in policy definition allowing remote code execution via PUT to /api/v1/policies	CWE-94