CVE-2024-24683
Description
Improper Input Validation vulnerability in Apache Hop Engine.This issue affects Apache Hop Engine: before 2.8.0. Users are recommended to upgrade to version 2.8.0, which fixes the issue. When Hop Server writes links to the PrepareExecutionPipelineServlet page one of the parameters provided to the user was not properly escaped. The variable not properly escaped is the "id", which is not directly accessible by users creating pipelines making the risk of exploiting this low. This issue only affects users using the Hop Server component and does not directly affect the client.
How to fix
- apache hop_engine2.8.0 or later
- org.apache.hop:hop2.8.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache hop_engine | v < 2.8.0 | 2.8.0 |
| org.apache.hop:hopMaven | v < 2.8.0 | 2.8.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.