What’s Vulnerable › Vulnerabilities

CVE-2024-24683: Apache Hop Engine: ID isn't escaped when generating HTML

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-03-19 · updated 2026-06-17
• Weakness: CWE-20

Description

Improper Input Validation vulnerability in Apache Hop Engine.This issue affects Apache Hop Engine: before 2.8.0. Users are recommended to upgrade to version 2.8.0, which fixes the issue. When Hop Server writes links to the PrepareExecutionPipelineServlet page one of the parameters provided to the user was not properly escaped. The variable not properly escaped is the "id", which is not directly accessible by users creating pipelines making the risk of exploiting this low. This issue only affects users using the Hop Server component and does not directly affect the client.

Affected products

• Apache Software Foundation Apache Hop Engine: before 2.8.0 — fixed in 2.8.0

How to fix

Upgrade to a fixed version: Apache Software Foundation Apache Hop Engine 2.8.0. Check the vendor advisory for mitigations.

References

• http://www.openwall.com/lists/oss-security/2024/03/18/1
• https://lists.apache.org/thread/ts203zssv1n9qth1wdlhk2bhos3vcq6t
• http://www.openwall.com/lists/oss-security/2024/03/18/1
• https://lists.apache.org/thread/ts203zssv1n9qth1wdlhk2bhos3vcq6t

Get alerted when CVE-2024-24683 or the next vulnerability affects your stack