CVE-2024-36265

Advisory

Affected versions of the apache-submarine package (specifically the submarine-server-core module) are vulnerable to Improper Authorization due to missing access control enforcement in the service’s core operations. The submarine-server-core component fails to verify user permissions before granting access, allowing any remote actor to bypass authorization checks. A remote attacker can exploit this by sending network requests to the submarine-server-core interface, gaining unauthorized access to sensitive data and functions, resulting in both confidentiality and integrity compromise.
# NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://github.com/advisories/GHSA-6q97-8v3g-rpxw
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-36265