Alluxio/alluxio

Alluxio/alluxio

GitHubGitHub
GitHubgithub.com
www.alluxio.iowww.alluxio.io
Releases162
Frequency3 weeks 5 days
Last Release
Stars7.21K
Alluxio, data orchestration for analytics and machine learning in the cloud
Log in to subscribe

CVE History

CVEAffectedPublishedCVSS v3CVSS v2
CVE-2023-38889NVD↗
<= 2.9.39.8 CRITICAL—

An issue in Alluxio v.2.9.3 and before allows an attacker to execute arbitrary code via a crafted script to the username parameter of lluxio.util.CommonUtils.getUnixGroups(java.lang.String).

CVE-2020-21485NVD↗
= 1.8.16.1 MEDIUM—

Cross Site Scripting vulnerability in Alluxio v.1.8.1 allows a remote attacker to executea arbitrary code via the path parameter in the browse board component.

CVE-2022-23848NVD↗
< 2.7.39.8 CRITICAL7.5 HIGH

In Alluxio before 2.7.3, the logserver does not validate the input stream. NOTE: this is not the same as the CVE-2021-44228 Log4j vulnerability.