CVE-2023-36106: PowerJob Incorrect Access Control Vulnerability
Summary
CVE-2023-36106: PowerJob incorrect access control vulnerability. Affects tech.powerjob:powerjob versions < 4.3.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PowerJob is a Maven package that provides a framework for distributed computing and task scheduling. It allows users to manage and execute tasks across multiple nodes in a distributed environment. The package is widely used for its ability to improve the efficiency and scalability of job execution. However, versions up to 4.3.2 of PowerJob are vulnerable to an incorrect access control issue.
Vulnerability Detail
The vulnerability in PowerJob 4.3.2 and earlier versions allows remote attackers to obtain sensitive information by exploiting an incorrect access control mechanism. Specifically, the vulnerability resides in the interface used for querying via the 'appId' parameter to '/container/list'. Attackers can leverage this vulnerability to access sensitive information that they are not authorized to view. This can lead to unauthorized disclosure of sensitive data, potentially compromising the security and privacy of the system.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is strongly recommended to apply the official patch or upgrade to a non-vulnerable version of PowerJob.
Conclusion
The PowerJob package up to version 4.3.2 is vulnerable to an incorrect access control issue that can lead to unauthorized disclosure of sensitive information. Users are strongly advised to upgrade to version 4.3.3 or apply the official patch to mitigate the risk. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tech.powerjob:powerjob →
FAQ
This vulnerability allows remote attackers to access sensitive information, potentially leading to unauthorized disclosure of data.
At the time of this advisory, there is no known exploit publicly available. However, it is important to apply the patch or upgrade as soon as possible to mitigate the risk.
No, only versions up to 4.3.2 of PowerJob are affected. The vulnerability has been fixed in version 4.3.3.
Yes, remote attackers can exploit this vulnerability by sending specially crafted requests to the affected interface.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your PowerJob installation is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it for any known vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for tech.powerjob:powerjob.
