CVE-2023-30867: Apache StreamPark (incubating): Authenticated system users could trigger SQL injection vulnerability
In the Streampark platform, when users log in to the system and use certain features, some pages provide a name-based fuzzy search, such as job names, role names, etc. The sql syntax :select from table where jobName like '%jobName%'. However, the jobName field may receive illegal parameters, leading to SQL injection. This could potentially result in information leakage.
Mitigation:
Users are recommended to upgrade to version 2.1.2, which fixes the issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-30867?
CVE-2023-30867 has been classified with a moderate severity level due to potential SQL injection vulnerabilities.
How do I fix CVE-2023-30867?
To fix CVE-2023-30867, upgrade to Apache StreamPark version 2.1.2 or later.
What types of systems are affected by CVE-2023-30867?
CVE-2023-30867 affects applications running Apache StreamPark versions between 2.0.0 and 2.1.2.
What can attackers achieve with CVE-2023-30867?
Attackers exploiting CVE-2023-30867 could execute arbitrary SQL commands that may compromise the database.
Is CVE-2023-30867 being actively exploited?
As of the latest information available, there have been no confirmed active exploits of CVE-2023-30867.