seaweedfs vulnerabilities (Bitnami)
14 vulnerabilities.
-
seaweedfsBitnami SeaweedFS: Hard-coded SSH host key can be presented by certain standalone SFTP Helm deployments 7.0 High -
seaweedfsBitnami SeaweedFS: Authenticated S3 object-scope bypass in PutObjectAcl allows overwriting a different object with the same basename 7.1 High -
seaweedfsBitnami SeaweedFS: SFTP path ACL literal prefix match permits cross-tenant file read and overwrite 8.1 High -
seaweedfsBitnami SeaweedFS S3 OIDC Bearer authentication bypasses IAM role trust policy 8.7 High -
seaweedfsBitnami SeaweedFS: Authenticated Cross-Prefix IDOR in Filer TUS Handler Enables Arbitrary Write to Tenant-Forbidden Paths 7.6 High -
seaweedfsBitnami SeaweedFS: Unauthenticated SSRF with response read-back via VolumeServer.FetchAndWriteNeedle 9.3 Critical -
seaweedfsBitnami SeaweedFS: Filer JWT allowed_prefixes literal prefix match allows cross-tenant access to sibling paths 8.1 High -
seaweedfsBitnami SeaweedFS: Unauthenticated filer IAM gRPC service grants S3 administrative control 9.8 Critical -
seaweedfsBitnami SeaweedFS: Improper authorization in the S3Tables / Iceberg REST management API lets a low-privileged S3 user enumerate administrator-owned table buckets 4.3 Medium -
seaweedfsBitnami SeaweedFS: Path traversal in the S3 gateway X-Amz-Copy-Source header allows cross-bucket object read 7.7 High -
seaweedfsBitnami SeaweedFS < 4.30 - Cross-Origin Information Disclosure via Unvalidated JSONP callback Parameter 2.3 Low -
seaweedfsBitnami SeaweedFS < 4.34 - Cross-Bucket Object Deletion via DeleteObjects Request-Body Keys 7.2 High -
seaweedfsBitnami SeaweedFS: Path traversal in the S3 and Iceberg REST gateways allows cross-bucket access 7.8 High -
seaweedfsBitnami SeaweedFS Vulnerable to SQL Injection 6.5 Medium