En bref
- CVE-2023-30867 est une vulnérabilité MOYENNE (CVSS 4.9) touchant org.apache.streampark:streampark, streampark (apache).
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.85%, plus élevée que 58.2% des vulnérabilités.
- Correctif : mettre à jour vers 2.1.2 ou plus récent.
Description
In the Streampark platform, when users log in to the system and use certain features, some pages provide a name-based fuzzy search, such as job names, role names, etc. The sql syntax :select * from table where jobName like '%jobName%'. However, the jobName field may receive illegal parameters, leading to SQL injection. This could potentially result in information leakage.
Mitigation:
Users are recommended to upgrade to version 2.1.2, which fixes the issue.
NVD description
In the Streampark platform, when users log in to the system and use certain features, some pages provide a name-based fuzzy search, such as job names, role names, etc. The sql syntax :select * from table where jobName like '%jobName%'. However, the jobName field may receive illegal parameters, leading to SQL injection. This could potentially result in information leakage.
Mitigation:
Users are recommended to upgrade to version 2.1.2, which fixes the issue.
Autres vulnérabilités de org.apache.streampark:streampark
Tout voir →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free