Talend Products CVEs
Important : For more recent security updates, see the Trust Center Updates section on Qlik Security Portal . Subscribe to the Trust Center Updates to be notified by email when a security update is published.
For more information about CVEs specific to Log4J and Spring4Shell, see Log4j2 Disclosure - CVE-2021-44228 and Spring4Shell Disclosure - CVE-2022-22965 .
|
Advisory ID |
Severity |
Current Description |
Patch |
Dates |
Link |
|
CVE-2023-36301 |
High |
Talend Data Catalog before 8.0-20230221 contains a directory traversal
Users of Talend Data Catalog should upgrade to 8.0-20230221 or a later release. |
8.0-20230221 |
Published: 2023-06-26 Updated: 2023-07-14
|
|
|
CVE-2023-33247 |
High |
All versions of the Talend Data Catalog remote harvesting server before 8.0-20230413 contain an /upgrade endpoint which allows an unauthenticated WAR file to be deployed on the server. A mitigation is that the remote harvesting server should be behind a firewall which only allows access to the Talend Data Catalog server. Users of Talend Data Catalog should upgrade to 8.0-20230413 or a later release. Credit: Ryan Wincey of Securifera, Stephen Yackey of Securifera, and Christian Weiler |
8.0-20230413 |
Published: 2023-05-24 Updated: 2023-06-09
|
|
|
CVE-2023-31444 |
High |
Talend Studio microservices allow unauthenticated access to the Jolokia endpoint of the microservice. This allows for remote access to the JVM via the Jolokia JMX-HTTP bridge. Please note that only Talend Studio microservice deployments are impacted, Talend Studio itself and other Talend Studio components are not impacted. The ESB Runtime is also not impacted. Please update to at least versions 8.0.1-R2022-09 or 7.3.1-R2022-10 to fix the issue. |
8.0.1-R2022-09 7.3.1-R2022-10 |
Published: 2023-04-28 Updated: 2023-04-28
|
|
|
CVE-2023-26264 |
Medium |
All versions before 8.0-20220907 are potentially vulnerable to XML External Entity (XXE) attacks in the license parsing code. Users of Talend Data Catalog should upgrade to 8.0-20220907 or a later release. |
8.0-20220907 |
Published: 2023-03-28 Updated: 2023-04-21
|
|
|
CVE-2023-26263 |
Medium |
All versions before 8.0-20230110 are potentially vulnerable to XML External Entity (XXE) attacks in the /MIMBWebServices/license endpoint of the remote harvesting server. Users of Talend Data Catalog who are using the remote harvesting server should upgrade to 8.0-20230110 or a later release. A mitigation is that the remote harvesting server should have the remote address valve configured to only allow the MM server to connect. Credit: Ryan Wincey of Securifera, Stephen Yackey of Securifera, and Christian Weiler |
8.0-20230110 |
Published: 2023-03-28 Updated: 2023-04-21
|
|
|
CVE-2022-45588 |
High |
All versions before R2022-09 of Talend's Remote Engine Gen 2 are potentially vulnerable to XML External Entity (XXE) type of attacks. Users should download the R2022-09 release or later and use it in place of the previous version. Talend Remote Engine Gen 1 and Talend Cloud Engine for Design are not impacted. Talend Analysis: This XXE vulnerability could only be exploited by someone with the appropriate rights to edit pipelines on the Talend platform. It could not be triggered remotely or by other user input. |
R2022-09 |
Published: 2023-02-01 Updated: 2023-04-04
|
|
|
CVE-2022-45589 |
High |
All versions before 8.0.1-R2022-10-RT and 7.3.1-R2022-09-RT of the Talend ESB Runtime are potentially vulnerable to SQL Injection attacks in the provisioning service only. Users of the provisioning service should upgrade to either 8.0.1-R2022-10-RT or 7.3.1-R2022-09-RT or a later release and use it in place of the previous version. Other Talend ESB Runtime services are not impacted by this vulnerability. Talend Analysis: The impact is limited as it requires administrative privileges to exploit. |
8.0.1-R2022-10-RT 7.3.1-R2022-09-RT |
Published: 2023-02-01 Updated: 2023-04-04 |
|
|
CVE-2022-31648 |
Medium |
Talend Administration Center is vulnerable to a reflected Cross-Site Scripting (XSS) issue in the SSO login endpoint. The issue is fixed for versions 8.0.x in TPS-5233, for versions 7.3.x in TPS-5324, and for versions 7.2.x in TPS-5235. Earlier versions of Talend Administration Center may also be impacted; and users are encouraged to update to a supported version. |
TPS-5233 TPS-5234 TPS-5235 |
Published: 2022-05-26 Updated: 2022-05-26 |
|
|
CVE-2022-29942 |
Medium |
Talend Administration Center has a vulnerability that allows an authenticated user to use the Service Registry 'Add' functionality to perform SSRF HTTP GET requests on URLs in the internal network. The issue is fixed for versions 8.0.x in TPS-5189, versions 7.3.x in TPS-5175, and versions 7.2.x in TPS-5201. Earlier versions of Talend Administration Center may also be impacted; users are encouraged to update to a supported version. |
TPS-5189 TPS-5175 TPS-5201 |
Published: 2022-05-03 Updated: 2022-05-03 |
|
|
CVE-2022-29943 |
Medium |
Talend Administration Center has a vulnerability that allows an authenticated user to use XML External Entity (XXE) processing to achieve read access as root on the remote filesystem. The issue is fixed for versions 8.0.x in TPS-5189, versions 7.3.x in TPS-5175, and versions 7.2.x in TPS-5201. Earlier versions of Talend Administration Center may also be impacted; users are encouraged to update to a supported version. |
TPS-5189 TPS-5175 TPS-5201 |
Published: 2022-05-03 Updated: 2022-05-03 |
|
|
CVE-2021-40684 |
Critical |
Talend ESB Runtime in all versions from 5.1 to 7.3.1-R2021-09, 7.2.1-R2021-09, 7.1.1-R2021-09, has an unauthenticated Jolokia HTTP endpoint which allows remote access to the JMX of the runtime container, which would allow an attacker the ability to read or modify the container or software running in the container. |
7.3.1-R2021-09 7.2.1-R2021-09 7.1.1-R2021-09 |
Published: 2022-02-10 Updated: 2022-10-05 |
|
|
CVE-2021-42837 |
Critical |
An issue was discovered in Talend Data Catalog before 7.3-20210930. After setting up SAML/OAuth, authentication is not correctly enforced on the native login page. Any valid user from the SAML/OAuth provider can be used as the username with an arbitrary password, and login will succeed. |
7.3-20210930 |
Published: 2022-02-10 Updated: 2022-11-08 |