CVE-2023-48396

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

Web Authentication vulnerability in Apache SeaTunnel. Since the jwt key is hardcoded in the application, an attacker can forge any token to log in any user.

Attacker can get secret key in /seatunnel-server/seatunnel-app/src/main/resources/application.yml and then create a token. This issue affects Apache SeaTunnel: 1.0.0.

Users are recommended to upgrade to version 1.0.1, which fixes the issue.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-290

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache SeaTunnel Web	1.0.0
apache	seatunnel	1.0.0

References

http://www.openwall.com/lists/oss-security/2024/07/30/1Mailing List, Third Party Advisory
https://lists.apache.org/thread/1tdxfjksx0vb9gtyt77wlr6rdcy1qwmwMailing List, Vendor Advisory
http://www.openwall.com/lists/oss-security/2024/07/30/1Mailing List, Third Party Advisory
https://lists.apache.org/thread/1tdxfjksx0vb9gtyt77wlr6rdcy1qwmwMailing List, Vendor Advisory

Timeline

Published: Jul 30, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2023

CVE-2023-483974.9In Init of protocolcalladapter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to remote informat CVE-2023-483987.5In ProtocolNetAcBarringInfo::ProtocolNetAcBarringInfo() of protocolnetadapter.cpp, there is a possible out of bounds read due to a missing b CVE-2023-483995.5In ProtocolMiscATCommandAdapter::Init() of protocolmiscadapter.cpp, there is a possible out of bounds read due to a missing bounds check. Th CVE-2023-48405.4The MapPress Maps for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'mappress' shortcode in versions up to CVE-2023-484015.5In GetSizeOfEenlRecords of protocoladapter.cpp, there is a possible out of bounds read due to an incorrect bounds check. This could lead to CVE-2023-484027.8In ppcfw_enable of ppcfw.c, there is a possible EoP due to a missing permission check. This could lead to local escalation of privilege with CVE-2023-484037.5In sms_DecodeCodedTpMsg of sms_PduCodec.c, there is a possible out of bounds read due to a heap buffer overflow. This could lead to remote i CVE-2023-484047.5In ProtocolMiscCarrierConfigSimInfoIndAdapter of protocolmiscadapter.cpp, there is a possible out of bounds read due to a missing bounds che CVE-2023-484056.7there is a possible way for the secure world to write to NS memory due to a logic error in the code. This could lead to local escalation of CVE-2023-484066.7there is a possible permanent DoS or way for the modem to boot unverified firmware due to a logic error in the code. This could lead to loca CVE-2023-484077.8there is a possible DCK won't be deleted after factory reset due to a logic error in the code. This could lead to local escalation of privil CVE-2023-484085.5In ProtocolNetSimFileInfoAdapter() of protocolnetadapter.cpp, there is a possible out of bounds read due to a missing bounds check. This cou