Missing Authentication for Critical Function Affecting org.apache.submarine:submarine-commons-utils package, versions [0.8.0,]
Threat Intelligence
EPSS
6.8% (95th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JAVA-ORGAPACHESUBMARINE-7251662
- published 13 Jun 2024
- disclosed 12 Jun 2024
- credit L0ne1y
Introduced: 12 Jun 2024
CVE-2024-36265 Open this link in a new tabHow to fix?
A fix was pushed into the master branch but not yet published.
Overview
Affected versions of this package are vulnerable to Missing Authentication for Critical Function that allows attackers to generate unauthorized JWT tokens, due to a hard-coded default secret value.
Note: A fixed release is not expected as this package is no longer maintained, but a patch has been added to the repository that retrieves SUBMARINE_AUTH_DEFAULT_SECRET from an environment variable rather than using a hard-coded value.
CVSS Scores
version 3.1