GitHub Advisoryadvisory · Maven, PyPI

GHSA-jwcg-wv5x-vg3g Apache Submarine Commons Utils has a hard-coded secret

MEDIUM Published 2024-06-12 Modified 2025-03-21 Official page ↗
Aliases
CVE-2024-36264
Ecosystem
Maven, PyPI
Packages
org.apache.submarine:submarine-commons-utils, apache-submarine
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-287, CWE-798
Reviewed
2024-06-12

Affected packages

• Maven org.apache.submarine:submarine-commons-utils: <= 0.8.0 (no fix yet) • PyPI apache-submarine: >= 0.8.0 (no fix yet)

Description

Improper Authentication vulnerability in Apache Submarine Commons Utils. This issue affects Apache Submarine Commons Utils: from 0.8.0. As this project is retired, we do not plan to release a version that fixes this issue. If the user doesn't explicitly set `submarine.auth.default.secret`, a default value will be used. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

Related

Alias · CVE (1)

  • CVE-2024-36264 ** UNSUPPORTED WHEN ASSIGNED ** Improper Authentication vulnerability in Apache Submarine Commons Utils. vulnerability

Weakness · CWE (2)

  • CWE-287 Improper Authentication weakness
  • CWE-798 Use of Hard-coded Credentials weakness

References