4Ra1N

Unsafe reflection occurs during the processing of the JDBC connection URL and AWS credentials profile resolution. An actor capable of influencing the connection parameter or the credentials profile can load and instantiate an arbitrary class available on the application classpath, potentially leading to remote code execution within the application context.

An authentication bypass exists in the DIGEST authenticator. If a client makes a DIGEST authenticated request with a `nonceCount` on the upper boundary of the replay window before `windowSize` requests are made, that request can be replayed once while the associated `nonceCount` remains within the replay window.

An off-by-one error in the rewrite valves occurs when the `[N]` flag is used. This causes the rewrite processing to restart at the second rule instead of the first rule.

An improper authorization issue exists where `security-role-ref` definitions are incorrectly used as role aliases within the Realm, in addition to their intended use with `Request.isUserInRole()`.

An incorrect authorization issue exists in the FORM authentication process. This allows the bypassing of a security constraint that restricts a user to POST access while denying GET access to a resource.

Improper access control and incorrect authorization allow an unauthenticated attacker to bypass security constraints. This occurs when a security constraint for a longer path is processed before a more restrictive constraint for a shorter sub-path, leading the system to evaluate constraints incorrectly and grant access to protected resources.

The JNDI ObjectFactory implementation `com.mchange.v2.naming.JavaBeanObjectFactory` allows the construction of objects from arbitrary classes and the initialization of JavaBean-style properties. This behavior enables JNDI injection and the use of deserialization gadgets, which are sequences of executable code that can be triggered during the deserialization of an object. For instance, configuring the `contentType` property of a Swing JEditorPane to text/html and the `text` property to HTML containing a stylesheet `<link>` can trigger an HTTP GET request to an arbitrary URL. This risk is increased by the `ReferenceIndirector`, which allows malicious JNDI Reference objects to be smuggled and dereferenced when an application reads a Java-serialized object.

An issue exists in the Server: Connection Handling component. An unauthenticated attacker with network access via multiple protocols can exploit this to cause a hang or a frequently repeatable crash, resulting in a complete Denial of Service (DOS), which is a condition where the service becomes unavailable to legitimate users.

An unsafe reflection issue exists where externally-controlled input can be used to select classes or code. Specifically, a user-controlled model can load arbitrary classes, which may lead to remote code execution.

An improper neutralization of input during web page generation allows for Cross-site Scripting (XSS). The `MessageServlet` in the ActiveMQ web console API copies every JMS message property into an HTTP response header without validation. This allows an attacker to overwrite and inject security headers by setting them on JMS messages returned by the servlet.

Improper input validation and improper control of code generation lead to a code injection issue. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at the '/api/jolokia/' endpoint on the web console. The default access policy allows execution operations on all ActiveMQ MBeans, specifically the `addNetworkConnector(String)` function within `BrokerService`. An authenticated attacker can use a crafted discovery URI to trigger the `brokerConfig` parameter of the VM transport via a "masterslave://" URL. This allows the loading of a Spring XML application context using `ResourceXmlApplicationContext`. Since this context instantiates singleton beans before the configuration is validated, arbitrary code can be executed on the broker's JVM through bean factory methods such as `Runtime.exec()`.

An issue in the Shell: Core Client component allows a low privileged attacker with access to the infrastructure where the software executes to compromise the system. The attack requires human interaction from a person other than the attacker and can result in a hang or frequently repeatable crash, leading to a complete Denial of Service (DOS), which is a condition where the service becomes unavailable to users.

An issue in the Shell: Core Client component allows a low privileged attacker with access to the infrastructure where the software executes to compromise the system. The attack requires human interaction from a person other than the attacker and can result in a hang or frequently repeatable crash, leading to a complete Denial of Service (DOS), which is a condition where the service becomes unavailable to users.

An issue in the Shell: Core Client component allows a high-privileged attacker with network access via multiple protocols to compromise the system. This flaw may result in unauthorized access to critical data or complete access to all data accessible by the shell. Although the issue resides within the shell, successful exploitation may significantly impact additional products due to a scope change.

An observable timing discrepancy exists in Apache Shiro. Before version 2.0.7, the code paths used for non-existent and existing users differ sufficiently, allowing a brute-force attack to determine if a request fails due to an invalid user or an incorrect password by measuring request timing. The most likely attack vector is a local attack. This issue is related to username enumeration, as discussed in the Shiro security model. Brute force attacks can typically be mitigated at the infrastructure level.

A possible arbitrary file read and SSRF vulnerability has been identified in Apache Kafka Client. Apache Kafka Clients accept configuration data for setting the SASL/OAUTHBEARER connection with the brokers, including `sasl.oauthbearer.token.endpoint.url` and `sasl.oauthbearer.jwks.endpoint.url`. Apache Kafka allows clients to read an arbitrary file and return the content in the error log, or sending requests to an unintended location. In applications where Apache Kafka Clients configurations can be specified by an untrusted party, attackers may use the `sasl.oauthbearer.token.endpoint.url` and `sasl.oauthbearer.jwks.endpoint.url` configuration to read arbitrary contents of the disk and environment variables or make requests to an unintended location. This flaw may be used in Apache Kafka Connect to escalate from REST API access to filesystem/environment/URL access, which may be undesirable in certain environments, including SaaS products.

A remote code injection issue exists in the Ambari Metrics and AMS Alerts feature, allowing authenticated users to inject and execute arbitrary code. The issue occurs when processing alert definitions, where malicious input can be injected into the alert script execution path. An attacker with authenticated access can exploit this issue to execute arbitrary commands on the server.

The issue is related to the IPAuthenticationProvider in the ZooKeeper Admin Server, which allows for authentication bypass via spoofing. This impacts IP-based authentication and is due to the default configuration using HTTP request headers to detect the client's IP address, specifically honoring the X-Forwarded-For HTTP header. This can be easily spoofed by an attacker, allowing them to bypass authentication. Successful exploitation could lead to information leakage or service availability issues, as Admin Server commands like snapshot and restore can be executed arbitrarily.

The issue is related to insufficient input validation in the Cloning component of the Oracle Global Lifecycle Management FMW Installer product. This allows an unauthenticated attacker with network access via SFTP to compromise the Oracle Global Lifecycle Management FMW Installer. Successful attacks can result in unauthorized creation, deletion, or modification access to critical data or all accessible data.

This issue affects Apache OFBiz, allowing unauthenticated endpoints to execute screen rendering code of screens if certain preconditions are met, such as when screen definitions do not explicitly check user permissions. The vulnerability is related to incorrect authorization and can lead to remote code execution. It is being actively exploited, and proof-of-concept exploits are available. Users are recommended to upgrade to version 18.12.15 to fix the issue.