Apache Hop security advisories

Security information for Apache Hop

Reporting

Do you want disclose a potential security issue for Apache Hop? You can read more about the projects’ security policy on their security page, and email your report to the Apache Security Team.

Advisories

This section is experimental: it provides advisories since 2023 and may lag behind the official CVE publications. It may also lack details found on the project security page. If you have any feedback on how you would like this data to be provided, you are welcome to reach out on our public mailinglist or privately on security@apache.org

ID isn’t escaped when generating HTML

CVE-2024-24683 [CVE json] [OSV json]

Last updated: 2024-03-19T08:20:12.966Z

Affected

  • Apache Hop Engine before 2.8.0

Description

Improper Input Validation vulnerability in Apache Hop Engine.

This issue affects Apache Hop Engine: before 2.8.0.

Users are recommended to upgrade to version 2.8.0, which fixes the issue.

When Hop Server writes links to the PrepareExecutionPipelineServlet page one of the parameters provided to the user was not properly escaped.
The variable not properly escaped is the “id”, which is not directly accessible by users creating pipelines making the risk of exploiting this low.

This issue only affects users using the Hop Server component and does not directly affect the client.

References

Credits

  • Jonathan Leitschuh (finder)