{"id":"GHSA-9x53-gr7p-4qf5","summary":"Apache SeaTunnel: Unauthenticated insecure access","details":"# Summary\n\nUnauthorized users can perform Arbitrary File Read and Deserialization\nattack by submit job using restful api-v1.\n\n# Details\nUnauthorized users can access `/hazelcast/rest/maps/submit-job` to submit\njob.\nAn attacker can set extra params in mysql url to perform Arbitrary File\nRead and Deserialization attack.\n\nThis issue affects Apache SeaTunnel: \u003c=2.3.10\n\n# Fixed\n\nUsers are recommended to upgrade to version 2.3.11, and enable restful api-v2 & open https two-way authentication , which fixes the issue.","aliases":["CVE-2025-32896"],"modified":"2025-06-19T16:58:18.448603Z","published":"2025-06-19T12:30:34Z","database_specific":{"nvd_published_at":"2025-06-19T11:15:24Z","cwe_ids":["CWE-306"],"severity":"LOW","github_reviewed":true,"github_reviewed_at":"2025-06-19T16:19:58Z"},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-32896"},{"type":"WEB","url":"https://github.com/apache/seatunnel/pull/9010"},{"type":"WEB","url":"https://github.com/apache/seatunnel/commit/53325aa3e76e3939f41a4bf3eaaf3ee56f13f311"},{"type":"PACKAGE","url":"https://github.com/apache/seatunnel"},{"type":"WEB","url":"https://lists.apache.org/thread/qvh3zyt1jr25rgvw955rb8qjrnbxfro9"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2025/04/12/1"}],"affected":[{"package":{"name":"org.apache.seatunnel:seatunnel-engine-server","ecosystem":"Maven","purl":"pkg:maven/org.apache.seatunnel/seatunnel-engine-server"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.11"}]}],"versions":["2.3.0","2.3.0-beta","2.3.1","2.3.10","2.3.2","2.3.3","2.3.4","2.3.5","2.3.6","2.3.7","2.3.8","2.3.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/06/GHSA-9x53-gr7p-4qf5/GHSA-9x53-gr7p-4qf5.json"}},{"package":{"name":"org.apache.seatunnel:seatunnel-engine-common","ecosystem":"Maven","purl":"pkg:maven/org.apache.seatunnel/seatunnel-engine-common"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.11"}]}],"versions":["2.3.0","2.3.0-beta","2.3.1","2.3.10","2.3.2","2.3.3","2.3.4","2.3.5","2.3.6","2.3.7","2.3.8","2.3.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/06/GHSA-9x53-gr7p-4qf5/GHSA-9x53-gr7p-4qf5.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U"}]}