Streampark
CVE-2024-29120
MEDIUM
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Primary rating from Vendor (apache) · only source for this CVE.
CVSS VectorVendor: apache
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Lifecycle Timeline
1DescriptionCVE.org
In Streampark (version < 2.1.4), when a user logged in successfully, the Backend service would return "Authorization" as the front-end authentication credential. User can use this credential to request other users' information, including the administrator's username, password, salt value, etc.
Mitigation:
all users should upgrade to 2.1.4
AnalysisAI
In Streampark (version < 2.1.4), when a user logged in successfully, the Backend service would return "Authorization" as the front-end authentication credential. Rated medium severity (CVSS 5.9), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified under CWE-212. In Streampark (version < 2.1.4), when a user logged in successfully, the Backend service would return "Authorization" as the front-end authentication credential. User can use this credential to request other users' information, including the administrator's username, password, salt value, etc. Mitigation: all users should upgrade to 2.1.4 Affected products include: Apache Streampark.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
More in Streampark
View allOn versions before 2.1.4, session is not invalidated after logout. Rated critical severity (CVSS 9.1), this vulnerabilit
On versions before 2.1.4, a user could log in and perform a template injection attack resulting in Remote Code Execution
In streampark, there is a project module that integrates Maven's compilation capability. Rated high severity (CVSS 7.2),
On versions before 2.1.4, after a regular user successfully logs in, they can manually make a request using the authoriz
In the Streampark platform, when users log in to the system and use certain features, some pages provide a name-based fu
In streampark, the project module integrates Maven's compilation capabilities. Rated medium severity (CVSS 4.7), this vu
SQL Injection vulnerability in Apache StreamPark.1.4 before 2.1.6. Rated high severity (CVSS 7.6), this vulnerability is
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today