Description
An issue in Alluxio v.2.9.3 and before allows an attacker to execute arbitrary code via a crafted script to the username parameter of lluxio.util.CommonUtils.getUnixGroups(java.lang.String).
Remediation
References
https://github.com/Alluxio/alluxio/issues/17766
Related Vulnerabilities
CVE-2019-10744 Vulnerability in maven package org.fujion.webjars:lodash
CVE-2023-40014 Vulnerability in maven package org.webjars.npm:openzeppelin__contracts-upgradeable
CVE-2022-24891 Vulnerability in maven package org.owasp.esapi:esapi
CVE-2023-35150 Vulnerability in maven package org.xwiki.platform:xwiki-platform-invitation-ui
CVE-2023-4853 Vulnerability in maven package io.quarkus:quarkus-keycloak-authorization