Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2023-38889: Alluxio: Unauthenticated code execution via crafted username input

CVE-2023-38889 · published 3 years ago

Summary

Old versions of Alluxio have a security issue that lets an attacker execute arbitrary code on the server by sending a specially crafted username. This could allow an attacker to access sensitive data or take control of the server. Update to the latest version of Alluxio as soon as possible to fix this issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Ecosystem	Vendor	Product	Affected versions
maven	alluxio	org.alluxio:alluxio-parent	<= 2.9.3
–	alluxio	alluxio	<= 2.9.3 `cpe:2.3:a:alluxio:alluxio::::::::`

Original advisory text

An issue in Alluxio v.2.9.3 and before allows an attacker to execute arbitrary code via a crafted script to the username parameter of lluxio.util.CommonUtils.getUnixGroups(java.lang.String).

References

https://github.com/advisories/GHSA-xrrh-h86w-pwfj
https://nvd.nist.gov/vuln/detail/CVE-2023-38889 Vendor Advisory
https://github.com/Alluxio/alluxio/issues/17766 Third Party Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/38xxx/CVE-2023-38889... Vendor Advisory

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker full control

Severity

9.8 Critical

Exploitation

<1% chance of attack within 30 days

Type

CWE-94Code Injection

Timeline

Published15 Aug 2023

Updated4 Nov 2026

First seen6 Mar 2026

Sources

GHSA-xrrh-h86w-pwfj · GHSA

CVE-2023-38889 · NVD

CVE-2023-38889 · OSV

Track software like this

Free during beta