[<prev] [next>] [day] [month] [year] [list]
Message-ID: <CAKYehMa_Fdx---OGfL6DK0Jdm1O67Y6VG0jfN1ukPf6zoDLRgg@mail.gmail.com>
Date: Fri, 21 Apr 2023 00:09:07 +0800
From: Huajie Wang <benjobs@...che.org>
To: oss-security@...ts.openwall.com
Cc: dev <dev@...eampark.apache.org>
Subject: CVE-2022-45802: Apache StreamPark (incubating): Upload any file to
any directory
Apache StreamPark (incubating): Upload any file to any directory
Severity: low
Versions Affected:
Apache StreamPark 1.0.0 before 2.0.0
Description:
Streampark allows any users to upload a jar as application, but there
is no mandatory verification of the uploaded file type, causing users
to upload some risky files, and may upload them to any directory,
Users of the affected versions should upgrade to Apache StreamPark
2.0.0 or later
Mitigation:
Users of the affected versions should apply one of the following
- Upgrade to Apache StreamPark 2.0.0 or later
References:
https://streampark.incubator.apache.orghttps://www.cve.org/CVERecord?id=CVE-2022-45802
Best,
Huajie Wang
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
