A security flaw has been discovered in conductor-oss conductor up to 3.33.0-rc10.
A security flaw has been discovered in conductor-oss conductor up to 3.33.0-rc10. This affects the function KafkaPublishTask.start of the file kafka/src/main/java/com/netflix/conductor/contribs/tasks/kafka/KafkaPublishTask.java. The manipulation of the argument kafka_request.bootStrapServers results in server-side request forgery. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- Oracle
- Product
- java
- CVSS
- 7.3
- EPSS
- 0.003 (p20)
- Exploitation
- public exploit code reported
- Exposure class
- Database
Why it ranks 27 (Notable)
- Public exploit code reported
- CVSS 7.3 high
- Product class: database
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.