Homepage
About Snyk

Improper Input Validation Affecting org.apache.hop:hop-engine package, versions [,2.8.0)

0.0
low

Snyk CVSS

    Attack Complexity Low
    Privileges Required High

    Threat Intelligence

    EPSS 0.04% (9th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-JAVA-ORGAPACHEHOP-6468188
  • published 20 Mar 2024
  • disclosed 19 Mar 2024
  • credit Jonathan Leitschuh
Report a new vulnerability Found a mistake?

Introduced: 19 Mar 2024

CVE-2024-24683 Open this link in a new tab
CWE-20 Open this link in a new tab

How to fix?

Upgrade org.apache.hop:hop-engine to version 2.8.0 or higher.

Overview

Affected versions of this package are vulnerable to Improper Input Validation due to the PrepareExecutionPipelineServlet page not properly escaping one of the parameters provided to the user. The variable not properly escaped is the id, which is not directly accessible by users creating pipelines, making the risk of exploiting this low. This issue only affects users using the Hop Server component and does not directly affect the client.