CVE-2024-36265
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk50th percentile - higher than 50% of all known CVEs
Summary
An incorrect authorization vulnerability in Apache Submarine Server Core allows an attacker to bypass authentication by sending specially crafted REST requests. The project is retired and no patch will be released.
Risk Assessment
The risk involves potential unauthorized access to the system by an attacker, which could lead to data confidentiality and integrity breaches. Due to lack of support, organizations face a persistent threat.
Recommendation
It is recommended to immediately replace Apache Submarine with an alternative solution or restrict access to the instance to trusted users only.
Original NVD description (English source)
** UNSUPPORTED WHEN ASSIGNED ** Incorrect Authorization vulnerability in Apache Submarine Server Core. This issue affects Apache Submarine Server Core: from 0.8.0. An attacker can bypass authentication by sending specially crafted REST requests. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.