MySQL Security Vulnerability in Apache SeaTunnel

CVE-2023-49198

7.5HIGH

Key Information

Vendor
Apache
Status
Apache Seatunnel Web
Vendor
CVE Published:
21 August 2024

Summary

Mysql security vulnerability in Apache SeaTunnel.

Attackers can read files on the MySQL server by modifying the information in the MySQL URL

allowLoadLocalInfile=true&allowUrlInLocalInfile=true&allowLoadLocalInfileInPath=/&maxAllowedPacket=655360 This issue affects Apache SeaTunnel: 1.0.0.

Users are recommended to upgrade to version [1.0.1], which fixes the issue.

Affected Version(s)

Apache SeaTunnel Web = 1.0.0

References

https://lists.apache.org/thread/48j9f1nsn037mgzc4j9o51nwg...
vendor-advisory

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Collectors

NVD DatabaseMitre Database

Credit

jiahua huang
.