CVE-2023-33247 - Talend Data Catalog remote harvesting server before 8.0-20230413 contains a /upgrade endpoint that allows an unauthenticated WAR file to be deployed on the server

Back Back to CVE browser

HIGH

Talend Data Catalog remote harvesting server before 8.0-20230413 contains a /upgrade endpoint that allows an unauthenticated WAR file to be deployed on the server

Published May 26, 2023

7.5

HIGH

CVSS 3.1

EPSS 0.46%

Description

Talend Data Catalog remote harvesting server before 8.0-20230413 contains a /upgrade endpoint that allows an unauthenticated WAR file to be deployed on the server. (A mitigation is that the remote harvesting server should be behind a firewall that only allows access to the Talend Data Catalog server.)

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-306

Missing Authentication

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-37415
Advisory
https://help.talend.com/r/en-US/Talend-Products-CVEs/Talend-Products-CVEs
Vendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-37415		Advisory
https://help.talend.com/r/en-US/Talend-Products-CVEs/Talend-Products-CVEs		Vendor Advisory