CVSS: 9.1EPSS: 0%CPEs: 1EXPL: 0CVE-2024-29070 – Apache StreamPark: session not invalidated after logout
https://notcve.org/view.php?id=CVE-2024-29070
23 Jul 2024 — On versions before 2.1.4, session is not invalidated after logout. When the user logged in successfully, the Backend service returns "Authorization" as the front-end authentication credential. "Authorization" can still initiate requests and access data even after logout. Mitigation: all users should upgrade to 2.1.4 En versiones anteriores a la 2.1.4, la sesión no se invalida después de cerrar sesión. Cuando el usuario inicia sesión correctamente, el servicio Backend devuelve "Authorization" como credencial... • https://lists.apache.org/thread/zslblrz1l0n9t67mqdv42yv75ncfn9zl • CWE-613: Insufficient Session Expiration •
CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-34457 – Apache StreamPark IDOR Vulnerability
https://notcve.org/view.php?id=CVE-2024-34457
22 Jul 2024 — On versions before 2.1.4, after a regular user successfully logs in, they can manually make a request using the authorization token to view everyone's user flink information, including executeSQL and config. Mitigation: all users should upgrade to 2.1.4 En versiones anteriores a la 2.1.4, después de que un usuario normal inicia sesión con éxito, puede realizar una solicitud manualmente utilizando el token de autorización para ver la información de flink de todos los usuarios, incluidos runSQL y config. Miti... • http://www.openwall.com/lists/oss-security/2024/07/22/2 • CWE-269: Improper Privilege Management CWE-639: Authorization Bypass Through User-Controlled Key •
CVSS: 9.0EPSS: 1%CPEs: 1EXPL: 0CVE-2024-29178 – Apache StreamPark: FreeMarker SSTI RCE Vulnerability
https://notcve.org/view.php?id=CVE-2024-29178
18 Jul 2024 — On versions before 2.1.4, a user could log in and perform a template injection attack resulting in Remote Code Execution on the server, The attacker must successfully log into the system to launch an attack, so this is a moderate-impact vulnerability. Mitigation: all users should upgrade to 2.1.4 En versiones anteriores a la 2.1.4, un usuario podía iniciar sesión y realizar un ataque de inyección de plantilla que generaba una ejecución remota de código en el servidor. El atacante debía iniciar sesión correc... • http://www.openwall.com/lists/oss-security/2024/07/18/1 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-29120 – Apache StreamPark: Information leakage vulnerability
https://notcve.org/view.php?id=CVE-2024-29120
17 Jul 2024 — In Streampark (version < 2.1.4), when a user logged in successfully, the Backend service would return "Authorization" as the front-end authentication credential. User can use this credential to request other users' information, including the administrator's username, password, salt value, etc. Mitigation: all users should upgrade to 2.1.4 En Streampark (versión <2.1.4), cuando un usuario iniciaba sesión correctamente, el servicio backend devolvía "Autorización" como credencial de autenticación de front-e... • http://www.openwall.com/lists/oss-security/2024/07/17/4 • CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer CWE-922: Insecure Storage of Sensitive Information •