Executive brief
OpenMetadata vulnerable to SpEL Injection in `PUT /api/v1/policies` (`GHSL-2023-252`)
Affected products
- Maven org.open-metadata:openmetadata-service
Junglewise Threat Intelligence
CVE-2024-28253: OpenMetadata vulnerable to SpEL Injection in `PUT /api/v1/policies` (`GHSL-2023-252`)
CVE-2024-28253 · Severity: low · CVSS 3.1 · Published 2024-04-23
Technologies: org.open-metadata:openmetadata-service (Maven). Vendors: Maven.
Related threats
- OpenMetadata sensitive information leak in TEST_CONNECTION workflow
- OpenMetadata SQL Injection
- OpenMetadata vulnerable to a SpEL Injection in `GET /api/v1/policies/validation/condition/<expr>` (`GHSL-2023-236`)
- OpenMetadata vulnerable to a SpEL Injection in `PUT /api/v1/events/subscriptions` (`GHSL-2023-251`)