CVE-2024-29120 Apache StreamPark: Information leakage vulnerability
Authenticated users can access sensitive administrator credentials and other user data by reusing the returned authorization token.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-29120?
CVE-2024-29120 is a medium-severity vulnerability in Apache StreamPark, published on 17 Jul 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In Streampark (version < 2.1.4), when a user logged in successfully, the Backend service would return "Authorization" as the front-end authentication credential. User can use this credential to request other users' information, including the administrator's username, password, salt value, etc.
Mitigation:
all users should upgrade to 2.1.4
Which versions are affected by CVE-2024-29120?
2 open source packages ship an affected version, including org.apache.streampark:streampark. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.streampark:streampark Maven | From 2.0.0 | 2.1.4 |
org.apache.streampark:streampark Maven | From 2.0.0 | 2.1.4 |
Products include Apache Streampark.
How do I fix CVE-2024-29120?
Upgrade org.apache.streampark:streampark to 2.1.4 or later.
Is CVE-2024-29120 being exploited?
There is no known exploitation of CVE-2024-29120 in the wild and no public exploit code.
Other vulnerabilities in Apache StreamPark
- CVE-2022-45802 Apache StreamPark (incubating): Upload any file to any directory
- CVE-2024-29070 Apache StreamPark: session not invalidated after logout
- CVE-2022-46365 Apache StreamPark (incubating): Logic error causing any account reset
- CVE-2024-29178 Apache StreamPark: FreeMarker SSTI RCE Vulnerability
- CVE-2023-52291 Apache StreamPark (incubating): Unchecked maven build params could trigger remote command execution
Sources
Also known as GHSA-hcf8-5j78-887v.