Vulnerabilities

TI-2023-20162 CVE-2023-38889 · GHSA-xrrh-h86w-pwfj

An issue in Alluxio v.2.9.3 and before allows an attacker to execute arbitrary code via a…

HIGH 82

An issue in Alluxio v.2.9.3 and before allows an attacker to execute arbitrary code via a crafted script to the username parameter of lluxio.util.CommonUtils.getUnixGroups(java.lang.String).

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01077 Published 2023-08-15 No fix listed CWE-94

TI-2020-14063 CVE-2020-21485 · GHSA-298m-hvgh-x9cw

Cross Site Scripting vulnerability in Alluxio v.1.8.1 allows a remote attacker to…

MEDIUM 60

Cross Site Scripting vulnerability in Alluxio v.1.8.1 allows a remote attacker to executea arbitrary code via the path parameter in the browse board component.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00514 Published 2023-06-20 No fix listed CWE-79

TI-2022-07851 CVE-2022-23848 · GHSA-j3ch-vjph-8q6v

In Alluxio before 2.7.3, the logserver does not validate the input stream.

MEDIUM 44

In Alluxio before 2.7.3, the logserver does not validate the input stream.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01211 Published 2022-02-20 Fixed in 2.7.3

Vulnerabilities

Filters

An issue in Alluxio v.2.9.3 and before allows an attacker to execute arbitrary code via a…

Cross Site Scripting vulnerability in Alluxio v.1.8.1 allows a remote attacker to…

In Alluxio before 2.7.3, the logserver does not validate the input stream.