CVE-2023-49898

Summary

CVE-2023-49898 is a vulnerability affecting the streampark project module that integrates Maven's compilation capability. The issue lies in the lack of validation for Maven's compilation parameters, enabling attackers to execute remote commands if they manage to log in to the streampark system with system-level permissions. Although the risk level is considered low due to the restricted access to the system, all users are advised to upgrade to version 2.1.2 to mitigate this vulnerability. An attacker could exploit this by customizing the splicing method in the settings.xml file, for instance, by using "||" or "&&" to trigger unwanted commands upon compilation success or failure.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.