Vulnerability DatabaseCVE-2024-36264
Mend.io Vulnerability Database
The largest open source vulnerability database
What is a Vulnerability ID?
New vulnerability? Tell us about it!
CVE-2024-36264
June 12, 2024
** UNSUPPORTED WHEN ASSIGNED ** Improper Authentication vulnerability in Apache Submarine Commons Utils. If the user doesn't explicitly set "submarine.auth.default.secret", a default value will be used. This issue affects Apache Submarine Commons Utils: from 0.8.0. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Additional Notes
The description of this vulnerability differs from MITRE.
Related Resources (8)
http://www.openwall.com/lists/oss-security/2024/06/12/2
https://github.com/apache/submarine/pull/1125
https://lists.apache.org/thread/7mo0c7vbhpo8thvybl8wwvb0bccrg7r4
https://issues.apache.org/jira/browse/SUBMARINE-1417
https://github.com/apache/submarine
https://nvd.nist.gov/vuln/detail/CVE-2024-36264
https://github.com/pypa/advisory-database/tree/main/vulns/apache-submarine/PYSEC-2024-97.yaml
https://github.com/apache/submarine/commit/7a1d551798c6785fc68fe028fc46f74c3ee6976d
Do you need more information?
Contact Us
CVSS v4
Base Score:
9.3
Attack Vector
NETWORK
Attack Complexity
LOW
Attack Requirements
NONE
Privileges Required
NONE
User Interaction
NONE
Vulnerable System Confidentiality
HIGH
Vulnerable System Integrity
HIGH
Vulnerable System Availability
HIGH
Subsequent System Confidentiality
NONE
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
CVSS v3
Base Score:
9.8
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH
Weakness Type (CWE)
Use of Hard-coded Credentials
CWE-798
Improper Authentication
CWE-287
EPSS
Base Score:
0.22