Description
An issue in Alluxio v.2.9.3 and before allows an attacker to execute arbitrary code via a crafted script to the username parameter of lluxio.util.CommonUtils.getUnixGroups(java.lang.String).
Remediation
References
https://github.com/Alluxio/alluxio/issues/17766
Related Vulnerabilities
CVE-2019-10795 Vulnerability in maven package org.webjars.npm:undefsafe
CVE-2011-0013 Vulnerability in maven package org.apache.tomcat:tomcat-catalina
CVE-2023-38695 Vulnerability in npm package @simonsmith/cypress-image-snapshot
CVE-2023-26111 Vulnerability in npm package node-static
CVE-2020-36185 Vulnerability in maven package com.fasterxml.jackson.core:jackson-databind