Description

missing input validation in Apache Hama may cause information disclosure through path traversal and XSS. Since Apache Hama is EOL, we do not expect these issues to be fixed.

Remediation

References

http://www.openwall.com/lists/oss-security/2022/11/21/1

https://lists.apache.org/thread/ztvoshd4kxvp5vlro52mpgpfxct4ft8l

Related Vulnerabilities

CVE-2015-2156 Vulnerability in maven package io.netty:netty-codec-http

CVE-2016-3086 Vulnerability in maven package org.apache.hadoop:hadoop-common

CVE-2020-5398 Vulnerability in maven package org.springframework:spring-web

CVE-2023-25764 Vulnerability in maven package org.jenkins-ci.plugins:email-ext

CVE-2020-28455 Vulnerability in npm package markdown-it-toc

Severity

High

Classification

CWE-20 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Tags

Mailing List Third Party Advisory Issue Tracking Vendor Advisory