Description
SQL misconfiguration in the Gravitino UI, in versions 1.0.0 and below, can allow a malicious user to read or truncate files.
Users are recommended to upgrade to version 1.0.0, which fixes this issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache Gravitino | 0.5.0 – < 1.0.0 | 1.0.0 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.gravitino:catalog-jdbc-common | >= 0.5.0, < 1.0.0 | 1.0.0 | GHSA-7ph3-grqh-pv9v |
References
- https://lists.apache.org/thread/s0hytcv17z52dwp5dojjjwgrtqtyh2xk vendor-advisory