CVE-2025-32896

Published Jun 19, 2025

Last updated 2 days ago

Apache SeaTunnel

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-32896 affects Apache SeaTunnel, a distributed data integration platform. Specifically, versions 2.3.1 through 2.3.10 are vulnerable. The vulnerability stems from unauthenticated access to the `/hazelcast/rest/maps/submit-job` REST API endpoint. Attackers can exploit this vulnerability by injecting malicious parameters into a MySQL connection URL via the REST API. This allows for arbitrary file read and deserialization attacks. To mitigate this issue, users are advised to upgrade to version 2.3.11 and enable restful API-v2 along with two-way HTTPS authentication.

Description: # Summary Unauthorized users can perform Arbitrary File Read and Deserialization attack by submit job using restful api-v1. # Details Unauthorized users can access `/hazelcast/rest/maps/submit-job` to submit job. An attacker can set extra params in mysql url to perform Arbitrary File Read and Deserialization attack. This issue affects Apache SeaTunnel: <=2.3.10 # Fixed Users are recommended to upgrade to version 2.3.11, and enable restful api-v2 & open https two-way authentication , which fixes the issue.
Source: security@apache.org
NVD status: Awaiting Analysis

Risk scores

CVSS 3.1

Type: Secondary
Base score: 6.5
Impact score: 3.6
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Severity: MEDIUM

Weaknesses

security@apache.org: CWE-306

Hype score: Not currently trending

References