CVE-2024-29120

Apache StreamPark: Information leakage vulnerability

Severity Score

"-"

*CVSS v-

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

Track

*SSVC

Descriptions

In Streampark (version < 2.1.4), when a user logged in successfully, the Backend service would return "Authorization" as the front-end authentication credential. User can use this credential to request other users' information, including the administrator's username, password, salt value, etc.

Mitigation:

all users should upgrade to 2.1.4

En Streampark (versión <2.1.4), cuando un usuario iniciaba sesión correctamente, el servicio backend devolvía "Autorización" como credencial de autenticación de front-end. El usuario puede usar esta credencial para solicitar información de otros usuarios, incluido el nombre de usuario, la contraseña, el valor de sal, etc. del administrador. Mitigación: todos los usuarios deben actualizar a 2.1.4

*Credits: L0ne1y

CVSS Scores

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

* Common Vulnerability Scoring System

SSVC

Decision:Track

Exploitation

None

Automatable

Tech. Impact

Partial

* Organization's Worst-case Scenario

Timeline

2024-03-16 CVE Reserved
2024-07-17 CVE Published
2024-07-18 EPSS Updated
2024-08-02 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer

CAPEC

References (2)

URL	Tag	Source
http://www.openwall.com/lists/oss-security/2024/07/17/4

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
https://lists.apache.org/thread/y3oqz7l8vd7jxxx3z2khgl625nvfr60j	2024-07-18

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Apache Software Foundation Search vendor "Apache Software Foundation"		Apache StreamPark Search vendor "Apache Software Foundation" for product "Apache StreamPark"				>= 2.0.0 < 2.1.4 Search vendor "Apache Software Foundation" for product "Apache StreamPark" and version " >= 2.0.0 < 2.1.4"		en		Affected