CVE-2024-30471 Apache StreamPipes: Potential creation of multiple identical accounts
An attacker can exploit a race condition during user registration to create multiple accounts with the same email, corrupting user management.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-30471?
CVE-2024-30471 is a medium-severity vulnerability in Apache StreamPipes, published on 17 Jul 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache StreamPipes in user self-registration. This allows an attacker to potentially request the creation of multiple accounts with the same email address until the email address is registered, creating many identical users and corrupting StreamPipe's user management. This issue affects Apache StreamPipes: through 0.93.0.
Users are recommended to upgrade to version 0.95.0, which fixes the issue.
Weakness: CWE-367
Which versions are affected by CVE-2024-30471?
5 open source packages ship an affected version, including org.apache.streampipes:streampipes-parent and streampipes. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.streampipes:streampipes-parent Maven | All versions | 0.95.0 |
org.apache.streampipes:streampipes-parent Maven | All versions | 0.95.0 |
streampipes PyPI | All versions | 0.95.0 |
streampipes PyPI | All versions | 0.95.0 |
streampipes PyPI | All versions | 0.95.0 |
Products include Apache Streampipes.
How do I fix CVE-2024-30471?
Upgrade org.apache.streampipes:streampipes-parent to 0.95.0 or later.
Is CVE-2024-30471 being exploited?
There is no known exploitation of CVE-2024-30471 in the wild and no public exploit code.
Other vulnerabilities in Apache StreamPipes
- CVE-2024-29868 Apache StreamPipes: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in Recovery Token Generation
- CVE-2023-31469 Apache StreamPipes: Privilege escalation through non-admin user
- CVE-2025-47411 Apache StreamPipes: Leverage of User ID for Privilege Escalation
- CVE-2024-31979 Apache StreamPipes: Possibility of SSRF in pipeline element installation process
- CVE-2024-24778 Apache StreamPipes: Resources Permission Escalation
Sources
Also known as GHSA-2qph-v9p2-q2gv, PYSEC-2024-172.