CVE-2024-38363

HighCVSS 8.5/10Last modified Jun 17, 2026

Description

Airbyte is a data integration platform for ELT pipelines. Airbyte connection builder docker image is vulnerable to RCE via SSTI which allows an authenticated remote attacker to execute arbitrary code on the server as the web server user. The connection builder is used to create and test new connectors. Sensitive information, such as credentials, could be exposed if a user tested a new connector on a compromised instance. The connection builder does not have access to any data processes. This vulnerability is fixed in 0.62.2.

Metrics

CVSS 3.1 8.5/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-1336

Affected software

No affected versions have been published.

Timeline

Published
Jul 9, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-383642.6DSpace is an open source software is a turnkey repository application used by more than 2,000 organizations and institutions worldwide to prCVE-2024-383658.1btcd is an alternative full node bitcoin implementation written in Go (golang). The btcd Bitcoin client (versions 0.10 to 0.24) did not corrCVE-2024-3836610.0trunk.cocoapods.org is the authentication server for the CoacoaPods dependency manager. The part of trunk which verifies whether a user has CVE-2024-383679.6trunk.cocoapods.org is the authentication server for the CoacoaPods dependency manager. Prior to commit d4fa66f49cedab449af9a56a21ab40697b9fCVE-2024-383689.3trunk.cocoapods.org is the authentication server for the CoacoaPods dependency manager. A vulnerability affected older pods which migrated fCVE-2024-383694.3XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The content of a document included CVE-2024-38378.8Use after free in QUIC in Google Chrome prior to 124.0.6367.60 allowed a remote attacker who had compromised the renderer process to potentiCVE-2024-383707.5GLPI is a free asset and IT management software package. Starting in 9.2.0 and prior to 11.0.0, it is possible to download a document from tCVE-2024-383719.8authentik is an open-source Identity Provider. Access restrictions assigned to an application were not checked when using the OAuth2 Device CVE-2024-383722.0Undici is an HTTP/1.1 client, written from scratch for Node.js. Depending on network and process conditions of a `fetch()` request, `responsCVE-2024-383738.1FreeRTOS-Plus-TCP is a lightweight TCP/IP stack for FreeRTOS. FreeRTOS-Plus-TCP versions 4.0.0 through 4.1.0 contain a buffer over-read issuCVE-2024-383747.5The CycloneDX core module provides a model representation of the SBOM along with utilities to assist in creating, validating, and parsing SB