CVE-2024-36264 — Improper Authentication in Software Foundation Apache Submarine Commons Utils

CWE-287 — Improper AuthenticationCWE-798 — Hard-coded Credentials5 documents4 sources
Severity
9.8CRITICALNVD
EPSS
0.2%
top 55.24%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Apache Software Foundation Apache Submarine Commons UtilsApache Submarine
Timeline
PublishedJun 12

Description

** UNSUPPORTED WHEN ASSIGNED ** Improper Authentication vulnerability in Apache Submarine Commons Utils. If the user doesn't explicitly set `submarine.auth.default.secret`, a default value will be used. This issue affects Apache Submarine Commons Utils: from 0.8.0. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects produc…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages2 packages

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

4
CVEList
Apache Submarine Commons Utils: default secret↗2024-06-12
▶
OSV
Apache Submarine Commons Utils has a hard-coded secret↗2024-06-12
▶
OSV
CVE-2024-36264: ** UNSUPPORTED WHEN ASSIGNED ** Improper Authentication vulnerability in Apache Submarine Commons Utils↗2024-06-12
▶
GHSA
Apache Submarine Commons Utils has a hard-coded secret↗2024-06-12
▶
CVE-2024-36264 — Improper Authentication | cvebase