Apache StreamPark CVE-2025-30001

The advisory provides no concrete prerequisites beyond the affected version range (Apache StreamPark 2.1.4 through 2.1.5; fixed in 2.1.6), so the exact feature or configuration triggering the incorrect permission assignment is not disclosed. The weakness class (CWE-279) implies the attacker needs to reach a code path where StreamPark executes a task or process with mis-assigned permissions - typically meaning the StreamPark web/API service must be network-reachable and the affected execution feature in use. Limiting factors: the real-world impact is partial (C:L/I:L/A:L), and despite the NVD PR:N rating, permission-assignment flaws of this type commonly require an existing low-privileged account, so defenders should treat unauthenticated exploitability as unconfirmed pending vendor detail.

This is a moderate-severity issue (CVSS 7.3) that does not rise to an emergency priority. The NVD CVSS vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated flaw, which on paper is concerning, but the impact is only Low across confidentiality, integrity, and availability (C:L/I:L/A:L), consistent with a partial permissions weakness rather than full system compromise. The EPSS score is low (0.55%, 45th percentile), indicating no meaningful signal of imminent mass exploitation. There is no CISA KEV listing and no public exploit code identified, so exploitation status is speculative. One point of friction: the underlying weakness is CWE-279 (Incorrect Execution-Assigned Permissions), which typically describes a process or task running with more permissions than intended - this usually presumes some existing access or an authenticated foothold, yet the NVD vector asserts PR:N (unauthenticated). This PR:N rating should be verified with the Apache advisory, as a pure 'execution-assigned permissions' flaw more commonly requires a low-privileged user. No SSVC decision data was provided. Overall: a real but non-critical issue - patch on a normal cadence, not as a fire drill.

A remote attacker interacts with an exposed Apache StreamPark instance (versions 2.1.4-2.1.5) where a task or process is executed with incorrectly assigned permissions, allowing the attacker to read or modify data or affect availability beyond their intended privilege level. Because CVSS rates attack complexity as low and the impact as partial across C/I/A, the practical outcome is limited information disclosure or minor tampering rather than full takeover. No public proof-of-concept exploit has been identified at time of analysis.