GHSA-v74c-qc46-9gg9

Apache Submarine Server Core has a SQL Injection Vulnerability

Source: GitHub Advisory Database (reviewed) High CVE-2024-36263

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.apache.submarine:submarine-server-core	<= 0.8.0	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Submarine Server Core. This issue affects Apache Submarine Server Core: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2024-36263 advisory
https://github.com/apache/submarine/pull/1121 web
https://github.com/apache/submarine/commit/4e68894a1c54d763ac2697ea1ac993793da4107c web
https://github.com/apache/submarine package
https://lists.apache.org/thread/8q9kbdg9gk9kpz5p8x6t7q8709l3vrmt web
http://www.openwall.com/lists/oss-security/2024/06/12/1 web