CVE-2023-48396

Published: Jul 30, 2024Modified: Jun 17, 2026

9.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Exploitability: 3.9 / Impact: 5.2

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Web Authentication vulnerability in Apache SeaTunnel. Since the jwt key is hardcoded in the application, an attacker can forge any token to log in any user. Attacker can get secret key in /seatunnel-server/seatunnel-app/src/main/resources/application.yml and then create a token. This issue affects Apache SeaTunnel: 1.0.0. Users are recommended to upgrade to version 1.0.1, which fixes the issue.

Affected (1)

Products: Apache: Seatunnel

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Apache Seatunnel	Version 1.0.0

Related CWEs

Authentication Bypass by Spoofing

This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

References (4)

http://www.openwall.com/lists/oss-security/2024/07/30/1

Source: security@apache.org

Mailing ListThird Party Advisory

https://lists.apache.org/thread/1tdxfjksx0vb9gtyt77wlr6rdcy1qwmw

Source: security@apache.org

Mailing ListVendor Advisory

http://www.openwall.com/lists/oss-security/2024/07/30/1

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

https://lists.apache.org/thread/1tdxfjksx0vb9gtyt77wlr6rdcy1qwmw

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListVendor Advisory

Timeline

No history available yet.