CVSS: 9.1EPSS: 0%CPEs: 1EXPL: 0CVE-2024-27905 – Apache Aurora: padding oracle can allow construction an authentication cookie
https://notcve.org/view.php?id=CVE-2024-27905
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Aurora. An endpoint exposing internals to unauthenticated users can be used as a "padding oracle" allowing an anonymous attacker to construct a valid authentication cookie. Potentially this could be combined with vulnerabilities in other components to achieve remote code execution. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. Exposición de información confidencial a una vulnerabilidad de actor no autorizado en Apache Aurora. Un endpoint que expone elementos internos a usuarios no autenticados se puede utilizar como un "oráculo de relleno" que permite a un atacante anónimo construir una cookie de autenticación válida. • http://www.openwall.com/lists/oss-security/2024/02/27/3 https://lists.apache.org/thread/564kbv3wqdzkscmdn2bg4vlk48qymryp • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: -EPSS: 0%CPEs: 2EXPL: 0CVE-2023-51747 – SMTP smuggling in Apache James
https://notcve.org/view.php?id=CVE-2023-51747
Apache James prior to versions 3.8.1 and 3.7.5 is vulnerable to SMTP smuggling. A lenient behaviour in line delimiter handling might create a difference of interpretation between the sender and the receiver which can be exploited by an attacker to forge an SMTP envelop, allowing for instance to bypass SPF checks. The patch implies enforcement of CRLF as a line delimiter as part of the DATA transaction. We recommend James users to upgrade to non vulnerable versions. Apache James anterior a las versiones 3.8.1 y 3.7.5 es vulnerable al contrabando SMTP. Un comportamiento indulgente en el manejo del delimitador de línea podría crear una diferencia de interpretación entre el remitente y el receptor que un atacante puede aprovechar para falsificar un sobre SMTP, permitiendo, por ejemplo, eludir las comprobaciones SPF. El parche implica la aplicación de CRLF como delimitador de línea como parte de la transacción de DATOS. Recomendamos a los usuarios de James que actualicen a versiones no vulnerables. • http://www.openwall.com/lists/oss-security/2024/02/27/4 https://lists.apache.org/thread/rxkwbkh9vgbl9rzx1fkllyk3krhgydko https://postfix.org/smtp-smuggling.html https://sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-worldwide • CWE-20: Improper Input Validation •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 1CVE-2023-51518 – Apache James server: Privilege escalation via JMX pre-authentication deserialisation
https://notcve.org/view.php?id=CVE-2023-51518
Apache James prior to version 3.7.5 and 3.8.0 exposes a JMX endpoint on localhost subject to pre-authentication deserialisation of untrusted data. Given a deserialisation gadjet, this could be leveraged as part of an exploit chain that could result in privilege escalation. Note that by default JMX endpoint is only bound locally. We recommend users to: - Upgrade to a non-vulnerable Apache James version - Run Apache James isolated from other processes (docker - dedicated virtual machine) - If possible turn off JMX Apache James anterior a las versiones 3.7.5 y 3.8.0 expone un endpoint JMX en localhost sujeto a deserialización previa a la autenticación de datos que no son de confianza. Dado un dispositivo de deserialización, esto podría aprovecharse como parte de una cadena de explotación que podría resultar en una escalada de privilegios. Tenga en cuenta que, de forma predeterminada, el endpoint JMX solo está vinculado localmente. Recomendamos a los usuarios: - Actualizar a una versión de Apache James no vulnerable - Ejecutar Apache James aislado de otros procesos (docker - máquina virtual dedicada) - Si es posible, desactive JMX • https://github.com/mbadanoiu/CVE-2023-51518 https://lists.apache.org/thread/wbdm61ch6l0kzjn6nnfmyqlng82qz0or • CWE-502: Deserialization of Untrusted Data •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-50379 – Apache Ambari: authenticated users could perform command injection to perform RCE
https://notcve.org/view.php?id=CVE-2023-50379
Malicious code injection in Apache Ambari in prior to 2.7.8. Users are recommended to upgrade to version 2.7.8, which fixes this issue. Impact: A Cluster Operator can manipulate the request by adding a malicious code injection and gain a root over the cluster main host. Inyección de código malicioso en Apache Ambari en versiones anteriores a 2.7.8. Se recomienda a los usuarios actualizar a la versión 2.7.8, que soluciona este problema. Impacto: un operador de clúster puede manipular la solicitud agregando una inyección de código malicioso y obteniendo una raíz sobre el host principal del clúster. • http://www.openwall.com/lists/oss-security/2024/02/27/1 https://lists.apache.org/thread/jglww6h6ngxpo1r6r5fx7ff7z29lnvv8 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 2.9EPSS: 0%CPEs: 4EXPL: 0CVE-2024-22371 – Apache Camel issue on ExchangeCreatedEvent
https://notcve.org/view.php?id=CVE-2024-22371
Exposure of sensitive data by by crafting a malicious EventFactory and providing a custom ExchangeCreatedEvent that exposes sensitive data. Vulnerability in Apache Camel.This issue affects Apache Camel: from 3.21.X through 3.21.3, from 3.22.X through 3.22.0, from 4.0.X through 4.0.3, from 4.X through 4.3.0. Users are recommended to upgrade to version 3.21.4, 3.22.1, 4.0.4 or 4.4.0, which fixes the issue. Exposición de datos confidenciales mediante la creación de un EventFactory malicioso y proporcionando un ExchangeCreatedEvent personalizado que expone datos confidenciales. Vulnerabilidad en Apache Camel. Este problema afecta a Apache Camel: desde 3.21.X hasta 3.21.3, desde 3.22.X hasta 3.22.0, desde 4.0.X hasta 4.0.3, desde 4.X hasta 4.3.0. • https://camel.apache.org/security/CVE-2024-22371.html https://access.redhat.com/security/cve/CVE-2024-22371 https://bugzilla.redhat.com/show_bug.cgi?id=2266024 • CWE-201: Insertion of Sensitive Information Into Sent Data •