Apache Submarine: SQL injection from unauthorized login
CVE-2023-37924

9.8CRITICAL

Key Information:

Vendor: Apache
Status: Apache Submarine
Vendor: CVE Published:; 22 November 2023

What is CVE-2023-37924?

Apache Submarine is susceptible to an SQL injection vulnerability that occurs during user login. This issue can allow unauthorized users to gain access to the workbench without proper credentials. To mitigate this risk, users are strongly advised to upgrade from versions 0.7.0 to the fixed version 0.8.0, which not only resolves this vulnerability but also enhances security by supporting OIDC authentication mode and ensuring that unauthenticated logins are eliminated. For users unable to upgrade, cherry-picking specific pull requests and rebuilding the submarine-server image may serve as a temporary fix.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch