{"timestamp":"2024-06-12T19:16:33.286576Z","id":"CVE-2024-36264","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}

[{"vendor":"Apache Software Foundation","product":"Apache Submarine Commons Utils","defaultStatus":"unaffected","collectionURL":"https://repo.maven.apache.org/maven2","packageName":"org.apache.submarine:submarine-commons-utils","versions":[{"version":"0.8.0","lessThanOrEqual":"*","versionType":"semver","status":"affected"}]}]

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

http://www.openwall.com/lists/oss-security/2024/06/12/2

https://github.com/apache/submarine/pull/1125

https://lists.apache.org/thread/7mo0c7vbhpo8thvybl8wwvb0bccrg7r4

NIST NVD-CWE-Other

NIST CWE-798

** UNSUPPORTED WHEN ASSIGNED ** Improper Authentication vulnerability in Apache Submarine Commons Utils.

This issue affects Apache Submarine Commons Utils: from 0.8.0.

As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.

NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

** UNSUPPORTED WHEN ASSIGNED ** Improper Authentication vulnerability in Apache Submarine Commons Utils.

If the user doesn't explicitly set `submarine.auth.default.secret`, a default value will be used.


This issue affects Apache Submarine Commons Utils: from 0.8.0.

As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.

NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

Apache Software Foundation http://www.openwall.com/lists/oss-security/2024/06/12/2

NIST AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NIST CWE-798

OR
     *cpe:2.3:a:apache:submarine:*:*:*:*:*:*:*:* versions from (including) 0.8.0

http://www.openwall.com/lists/oss-security/2024/06/12/2 No Types Assigned

http://www.openwall.com/lists/oss-security/2024/06/12/2 Mailing List, Third Party Advisory

https://github.com/apache/submarine/pull/1125 No Types Assigned

https://github.com/apache/submarine/pull/1125 Issue Tracking, Patch, Vendor Advisory

https://lists.apache.org/thread/7mo0c7vbhpo8thvybl8wwvb0bccrg7r4 No Types Assigned

https://lists.apache.org/thread/7mo0c7vbhpo8thvybl8wwvb0bccrg7r4 Mailing List, Vendor Advisory

Apache Software Foundation http://www.openwall.com/lists/oss-security/2024/06/12/2 [No types assigned]

Apache Software Foundation unsupported-when-assigned

** UNSUPPORTED WHEN ASSIGNED ** Improper Authentication vulnerability in Apache Submarine Commons Utils.

This issue affects Apache Submarine Commons Utils: from 0.8.0.

As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.

NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

Apache Software Foundation CWE-287

Apache Software Foundation https://github.com/apache/submarine/pull/1125 [No types assigned]

Apache Software Foundation https://lists.apache.org/thread/7mo0c7vbhpo8thvybl8wwvb0bccrg7r4 [No types assigned]