CVE-2023-51699CWE-78

OS Command Injection for Fluid Users with JuicefsRuntime

Medium · published March 15, 2024

CVSS v3.1
4.0
EPSS
1%
Percentile
48.6
In the wild
Unconfirmed
What it is

Fluid is an open source Kubernetes-native Distributed Dataset Orchestrator and Accelerator for data-intensive applications. An OS command injection vulnerability within the Fluid project's JuicefsRuntime can potentially allow an authenticated user, who has the authority to create or update the K8s CRD Dataset/JuicefsRuntime, to execute arbitrary OS commands within the juicefs related containers. This could lead to unauthorized access, modification or deletion of data. Users who're using versions < 0.9.3 with JuicefsRuntime should upgrade to v0.9.3.

The record
Technical detail
CVSS v3.1
4.0 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00611 · 48.6th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2024-03-15T19:08Z
EPSS history
Timeline
  • 15 MAR 19:08Z
    OS Command Injection for Fluid Users with JuicefsRuntime
    cvelistv5