Streampark
CVE-2024-29070
CRITICAL
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Primary rating from Vendor (apache) · only source for this CVE.
CVSS VectorVendor: apache
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Lifecycle Timeline
1DescriptionCVE.org
On versions before 2.1.4, session is not invalidated after logout. When the user logged in successfully, the Backend service returns "Authorization" as the front-end authentication credential. "Authorization" can still initiate requests and access data even after logout.
Mitigation:
all users should upgrade to 2.1.4
AnalysisAI
On versions before 2.1.4, session is not invalidated after logout. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified under CWE-613. On versions before 2.1.4, session is not invalidated after logout. When the user logged in successfully, the Backend service returns "Authorization" as the front-end authentication credential. "Authorization" can still initiate requests and access data even after logout. Mitigation: all users should upgrade to 2.1.4 Affected products include: Apache Streampark. Version information: before 2.1.4.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
More in Streampark
View allOn versions before 2.1.4, a user could log in and perform a template injection attack resulting in Remote Code Execution
In streampark, there is a project module that integrates Maven's compilation capability. Rated high severity (CVSS 7.2),
On versions before 2.1.4, after a regular user successfully logs in, they can manually make a request using the authoriz
In Streampark (version < 2.1.4), when a user logged in successfully, the Backend service would return "Authorization" as
In the Streampark platform, when users log in to the system and use certain features, some pages provide a name-based fu
In streampark, the project module integrates Maven's compilation capabilities. Rated medium severity (CVSS 4.7), this vu
SQL Injection vulnerability in Apache StreamPark.1.4 before 2.1.6. Rated high severity (CVSS 7.6), this vulnerability is
Same weakness CWE-613 – Insufficient Session Expiration
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today