Lucene search

Veracode Vulnerability DatabaseVERACODE:48109

HistoryJul 18, 2024 - 5:16 a.m.

Command Injection

2024-07-1805:16:15

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

command injection

apache streampark

input validation

CVSS3

4.7

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

AI Score

7.8

Confidence

High

EPSS

0.005

Percentile

76.8%

JSON

org.apache.streampark:streampark is vulnerable to command injection due to insufficient input parameter validation, which allows attackers to insert malicious commands for execution. The risk level of this vulnerability is very low as it requires the user to log in with system-level permissions.

References

www.openwall.com/lists/oss-security/2024/07/17/2

lists.apache.org/thread/xhx7jt1t24s6d7o435wxng8t0ojfbfh5