CVE-2023-49198CWE-552

Apache SeaTunnel Web: Arbitrary file read vulnerability

High · published August 21, 2024

CVSS v3.1
7.5
EPSS
1%
Percentile
60.4
In the wild
Unconfirmed
What it is

Mysql security vulnerability in Apache SeaTunnel.

Attackers can read files on the MySQL server by modifying the information in the MySQL URL

allowLoadLocalInfile=true&allowUrlInLocalInfile=true&allowLoadLocalInfileInPath=/&maxAllowedPacket=655360

This issue affects Apache SeaTunnel: 1.0.0.

Users are recommended to upgrade to version [1.0.1], which fixes the issue.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00934 · 60.4th percentile
Weakness
CWE-552 · Files or Directories Accessible to External Parties
Published
2024-08-21T09:37Z
EPSS history
Timeline
  • 21 AUG 09:37Z
    Apache SeaTunnel Web: Arbitrary file read vulnerability
    cvelistv5