CVE-2024-36263 Apache Submarine Server Core: SQL injection

What is CVE-2024-36263?

CVE-2024-36263 is a high-severity SQL injection vulnerability in Apache Submarine Server Core, published on 12 Jun 2024. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Submarine Server Core.

This issue affects Apache Submarine Server Core: all versions.

As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.

NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

Weakness: CWE-89

Which versions are affected by CVE-2024-36263?

2 open source packages ship an affected version, including org.apache.submarine:submarine-server-core. It affects 1 product.

Products include Apache Submarine.

How do I fix CVE-2024-36263?

No fix has been published for CVE-2024-36263 yet. Limit exposure of the affected software until one is available.

Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.

Is CVE-2024-36263 being exploited?

There is no known exploitation of CVE-2024-36263 in the wild and no public exploit code.

Other vulnerabilities in Apache Submarine Server Core

• CVE-2024-36264 Apache Submarine Commons Utils: default secret Critical 9.8
• CVE-2024-36265 Apache Submarine Server Core: authorization bypass Critical 9.8
• CVE-2023-37924 Apache Submarine: SQL injection from unauthorized login Critical 9.8
• CVE-2023-46302 Apache Submarine: Fix CVE-2022-1471 SnakeYaml unsafe deserialization Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-v74c-qc46-9gg9.