CVE-2023-49898
CVSS 3.1 Score 7.2 of 10 (high)
Details
Summary
CVE-2023-49898 is a vulnerability affecting the streampark project module that integrates Maven's compilation capability. The issue lies in the lack of validation for Maven's compilation parameters, enabling attackers to execute remote commands if they manage to log in to the streampark system with system-level permissions. Although the risk level is considered low due to the restricted access to the system, all users are advised to upgrade to version 2.1.2 to mitigate this vulnerability. An attacker could exploit this by customizing the splicing method in the settings.xml file, for instance, by using "||" or "&&" to trigger unwanted commands upon compilation success or failure.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Affected Vendors
- Apache Software Foundation
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions