Talend vulnerabilities
We track 4 vulnerabilities in Talend products across 4 products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on May 26, 2023.
Latest Talend vulnerabilities
- 7.5 High severity
Data Catalog: Missing Authentication for Critical Functionality
Talend Data Catalog remote harvesting server before 8.0-20230413 contains a /upgrade endpoint that allows an unauthenticated WAR file to be deployed on the server. (A mitigation is that the remote harvesting server should be behind a firewall that only allows
- 7.5 High severity
Studio: Missing Authentication for Critical Functionality
In Talend Studio before 7.3.1-R2022-10 and 8.x before 8.0.1-R2022-09, microservices allow unauthenticated access to the Jolokia endpoint of the microservice. This allows for remote access to the JVM via the Jolokia JMX-HTTP bridge.
- 7.2 High severity
Esb Runtime: Improper Neutralization of Special Elements used in an SQL Command
All versions before 8.0.1-R2022-10-RT and 7.3.1-R2022-09-RT of the Talend ESB Runtime are potentially vulnerable to SQL Injection attacks in the provisioning service only. Users of the provisioning service should upgrade to either 8.0.1-R2022-10-RT or 7.3.1-R2
- 7.8 High severity
Remote Engine Gen 2: Improper Restriction of XML External Entity Reference
All versions before R2022-09 of Talend's Remote Engine Gen 2 are potentially vulnerable to XML External Entity (XXE) type of attacks. Users should download the R2022-09 release or later and use it in place of the previous version. Talend Remote Engine Gen 1 an