OpenMetadata vulnerable to a SpEL Injection in `PUT /api/v1/events/subscriptions` (`GHSL-2023-251`)

SpEL Injection in PUT /api/v1/events/subscriptions GHSL-2023-251 Please note, only authenticated users have access to PUT / POST APIS for /api/v1/policies. Non authenticated users will not be able to access these APIs to exploit the vulnerability. A user must exist in OpenMetadata and have...

CVE-2024-28253

OpenMetadata versions prior to 1.3.1 are vulnerable to Remote Code Execution (RCE) via a SpEL Injection vulnerability in the PUT /api/v1/policies endpoint. The root cause is that CompiledRule::validateExpression is triggered during PolicyRepository.prepare, which is executed before the applicatio...