CVE Catalog
CVE-2023-38889
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk0.99%
58th percentile - higher than 58% of all known CVEs
Summary
An issue in Alluxio v.2.9.3 and before allows an attacker to execute arbitrary code via a crafted script to the username parameter of lluxio.util.CommonUtils.getUnixGroups(java.lang.String).
Risk Assessment
An attacker can exploit this vulnerability to execute remote code, potentially leading to system takeover or data leakage.
Recommendation
It is recommended to upgrade Alluxio to version 2.9.4 or later to mitigate this vulnerability.
Original NVD description (English source)
An issue in Alluxio v.2.9.3 and before allows an attacker to execute arbitrary code via a crafted script to the username parameter of lluxio.util.CommonUtils.getUnixGroups(java.lang.String).