Server-Side Request Forgery

Apache Gravitino is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to insufficient validation of job template URIs in JobManager, allowing authenticated attackers to force the server to send HTTP requests to arbitrary internal network services or cloud metadata endpoints...