What is CVE-2023-46302?

CVE-2023-46302 is a critical-severity vulnerability in Apache Submarine, classified under Deserialization of Untrusted Data. CVSS score: 9.8/10. Published 2023-11-20.

How severe is CVE-2023-46302?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Deserialization in Apache Submarine

CVE-2023-46302

Apache Software Foundation Apache Submarine has a bug when serializing against yaml. The bug is caused by snakeyaml https://nvd.nist.gov/vuln/detail/CVE-2022-1471 . Apache Submarine uses JAXRS to define REST endpoints. In order to handl…

Vulnerability class: Insecure Deserialization

EPSS: 0.017 (75.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Apache Submarine
Apache Software Foundation Submarine — versions 0.7.0

Weakness classification (CWE)

CWE-502 — Deserialization of Untrusted Data

References

security@apache.org (issue-tracking, Exploit, Issue Tracking)
security@apache.org (Patch, patch, Issue Tracking)
security@apache.org (vendor-advisory, Mailing List)

Frequently asked questions

What is CVE-2023-46302?: CVE-2023-46302 is a critical-severity vulnerability in Apache Submarine, classified under Deserialization of Untrusted Data. CVSS score: 9.8/10. Published 2023-11-20.
How severe is CVE-2023-46302?: Critical severity. CVSS v3 base score is 9.8 out of 10.