CVE-2024-28847

OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team collaboration. Similarly to the GHSL-2023-250 issue, AlertUtil::validateExpression is also called from EventSubscriptionRepository.prepare,...

CVE-2024-28847

OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team collaboration. Similarly to the GHSL-2023-250 issue, AlertUtil::validateExpression is also called from EventSubscriptionRepository.prepare,...

CVE-2024-28847

The OpenMetadata platform (versions prior to 1.2.4 ) is vulnerable to Remote Code Execution (RCE) via a SpEL injection flaw. The vulnerability resides in the AlertUtil::validateExpression method, which is triggered during the prepare() call in EventSubscriptionRepository. Specifically, an attacke...

CVE-2024-28847 SpEL Injection in `PUT /api/v1/events/subscriptions` in OpenMetadata

OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team collaboration. Similarly to the GHSL-2023-250 issue, AlertUtil::validateExpression is also called from EventSubscriptionRepository.prepare,...

CVE-2024-28847

creationtimestamp| type| source ---|---|--- 2024-03-15 06:11:53+00:00| published-proof-of-concept| https://github.com/open-metadata/OpenMetadata/security/advisories/GHSA-8p5r-6mvv-2435 2024-03-15 21:22:18+00:00| seen| https://t.me/ctinow/209162 2024-03-15 21:26:31+00:00| seen|...