Description
Diagnosis Controller miss parameter validation, so user may attacked by command injection via HTTP Request.
Remediation
References
https://lists.apache.org/thread/7ctchj24dofgsj9g1rg1245cms9myb34
Related Vulnerabilities
CVE-2023-39154 Vulnerability in maven package com.qualys.plugins:qualys-was
CVE-2022-41940 Vulnerability in maven package org.webjars.bower:engine.io
CVE-2023-30867 Vulnerability in maven package org.apache.streampark:streampark
CVE-2023-32262 Vulnerability in maven package org.jenkins-ci.plugins:dimensionsscm
CVE-2021-36749 Vulnerability in maven package org.apache.druid:druid-core