Skip to content

Product

Apache SeaTunnel Web vulnerabilities

2 published CVES affecting Apache SeaTunnel Web, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
2
Critical
1
High
1
Medium
0
Low
0
Unscored
0
CISA KEV
0

Latest Apache SeaTunnel Web CVEs

Newest publication first

  1. CVE-2023-49198 Apache SeaTunnel Web: Arbitrary file read vulnerability

    Published
    HighCVSS 7.5 EPSS 0.93%

    Mysql security vulnerability in Apache SeaTunnel. Attackers can read files on the MySQL server by modifying the information in the MySQL URL allowLoadLocalInfile=true&allowUrlInLocalInfile=true&allowLoadLocalInfileInPath=/&maxAllowedPacket=655360 This issue affects Apache SeaTunn...

  2. CVE-2023-48396 Apache SeaTunnel Web: Authentication bypass

    Published
    CriticalCVSS 9.1 EPSS 0.72%

    Web Authentication vulnerability in Apache SeaTunnel. Since the jwt key is hardcoded in the application, an attacker can forge any token to log in any user. Attacker can get secret key in /seatunnel-server/seatunnel-app/src/main/resources/application.yml and then create a token....

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.