Read the docs
TI-2023-19357 Aliases CVE-2023-37924GHSA-v5gj-fx3g-hcpw

Apache Submarine: SQL injection from unauthorized login

Priority MEDIUM 52CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
SQL injection
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-89.

Summary

Apache Software Foundation Apache Submarine has an SQL injection vulnerability when a user logs in. This issue can result in unauthorized login. Now we have fixed this issue and now user must have the correct login to access workbench. This issue affects Apache Submarine: from 0.7.0 before 0.8.0. We recommend that all submarine users with 0.7.0 upgrade to 0.8.0, which not only fixes the issue, supports the oidc authentication mode, but also removes the case of unauthenticated logins. If using the version lower than 0.8.0 and not want to upgrade, you can try cherry-pick PR https://github.com/apache/submarine/pull/1037 https://github.com/apache/submarine/pull/1054 and rebuild the submarine-server image to fix this.

Why it matters now

EPSS 0.07167 94th percentileScored 2026-11-07
Fix Fixed Apache Submarine (Apache Software Foundation): 0.8.0apache-submarine (PyPI): 0.8.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Submarine0.7.0 to before 0.8.00.8.0Patch availableCNA
—apache-submarine (PyPI)0.7.0 to before 0.8.00.8.0Patch availableGHSA-v5gj-fx3g-hcpw
  • Apache Submarine VendorApache Affected 0.7.0 to before 0.8.0 Fixed in 0.8.0 Patch available CNA
  • apache-submarine (PyPI) Vendor— Affected 0.7.0 to before 0.8.0 Fixed in 0.8.0 Patch available GHSA-v5gj-fx3g-hcpw

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:submarine:*:*:*:*:*:*:*:*0.7.0 to before 0.8.0VulnerableApache
  • cpe:2.3:a:apache:submarine:*:*:*:*:*:*:*:* Versions 0.7.0 to before 0.8.0 Vulnerable ·Apache

Remediation

  • Fix · CNA Apache Submarine (Apache Software Foundation) Fixed in 0.8.0
  • Fix · GHSA-v5gj-fx3g-hcpw apache-submarine (PyPI) Fixed in 0.8.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-37924
  2. 2026-10-03 Alias added: GHSA-v5gj-fx3g-hcpw

References

Patch 1

Advisory 3

Other 3

  • TI-2023-24917 Apache Submarine: Fix CVE-2022-1471 SnakeYaml unsafe deserialization CVSS 3.1CRITICAL 9.8
  • TI-2024-24083 Apache Submarine Commons Utils: default secret CVSS 3.1CRITICAL 9.8
  • TI-2024-24084 Apache Submarine Server Core: authorization bypass CVSS 3.1CRITICAL 9.8
  • TI-2024-24082 Apache Submarine Server Core: SQL injection CVSS 3.1HIGH 8.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences