Skip to content
OpenAdvisories
High · 7.5 CVE-2023-49198 EUVD-2024-2538GHSA-8m84-h9hh-3cfh

Apache SeaTunnel Web: Arbitrary file read vulnerability

Published Aug 21, 2024 · Updated Aug 23, 2024 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache SeaTunnel Web Package: org.apache.seatunnel:seatunnel Ecosystem: Maven

Description

Mysql security vulnerability in Apache SeaTunnel.

Attackers can read files on the MySQL server by modifying the information in the MySQL URL

allowLoadLocalInfile=true&allowUrlInLocalInfile=true&allowLoadLocalInfileInPath=/&maxAllowedPacket=655360
This issue affects Apache SeaTunnel: 1.0.0.

Users are recommended to upgrade to version [1.0.1], which fixes the issue.

Affected products

VendorProductAffectedFixed
Apache Software Foundation Apache SeaTunnel Web 1.0.0 —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.apache.seatunnel:seatunnel >= 1.0.0, < 1.0.1 1.0.1 GHSA-8m84-h9hh-3cfh

References