CVE-2023-33247 File upload in n/a

High 7.5 Published 26 May 2023 Updated 16 Jan 2025

Unauthenticated attackers can upload and deploy WAR files via the /upgrade endpoint, leading to remote code execution on the Talend Data Catalog server.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-33247?

CVE-2023-33247 is a high-severity vulnerability in n/a, published on 26 May 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Talend Data Catalog remote harvesting server before 8.0-20230413 contains a /upgrade endpoint that allows an unauthenticated WAR file to be deployed on the server. (A mitigation is that the remote harvesting server should be behind a firewall that only allows access to the Talend Data Catalog server.)

Weakness: CWE-306

Which versions are affected by CVE-2023-33247?

It affects 1 product.

Products include Talend Data Catalog.

How do I fix CVE-2023-33247?

No fix has been published for CVE-2023-33247 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-33247 being exploited?

There is no known exploitation of CVE-2023-33247 in the wild and no public exploit code.

Sources

Also known as GHSA-x79h-5263-4x77.