Improper Authentication in Apache Submarine Commons Utils by Apache

CVE-2024-36264

Summary

An improper authentication vulnerability exists in Apache Submarine Commons Utils, which arises when users fail to explicitly set the 'submarine.auth.default.secret' configuration. In such cases, the software defaults to a predefined secret that may not offer adequate security, exposing the system to unauthorized access. This vulnerability is particularly concerning as it affects a retired project, meaning no further patches will be developed to address this issue. Users are advised to seek alternative solutions or limit access to the application only to trusted users to mitigate potential security risks.

References