Description

Fuseki server wrapper and management API in fuseki before 1.0.1 downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.

Remediation

References

https://nodesecurity.io/advisories/278

Related Vulnerabilities

CVE-2020-10714 Vulnerability in maven package org.wildfly.security:wildfly-elytron

CVE-2020-13920 Vulnerability in maven package org.apache.activemq:activemq-broker

CVE-2023-3894 Vulnerability in maven package com.fasterxml.jackson.dataformat:jackson-dataformat-toml

CVE-2019-0201 Vulnerability in maven package org.apache.zookeeper:zookeeper

CVE-2021-27568 Vulnerability in maven package net.minidev:json-smart

Severity

Critical

Classification

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Third Party Advisory CWE-311