Lucene search

ApacheCVE-2022-45802

HistoryMay 01, 2023 - 3:15 p.m.

CVE-2022-45802

2023-05-0115:15:08

CWE-434

apache

web.nvd.nist.gov

streampark

jar

file upload

security vulnerability

cve-2022-45802

nvd

apache streampark 2.0.0

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.4

Confidence

High

EPSS

0.005

Percentile

77.7%

JSON

Streampark allows any users to upload a jar as application, but there is no mandatory verification of the uploaded file type, causing users to upload some high-risk files, and may upload them to any directory, Users of the affected versions should upgrade to Apache StreamPark 2.0.0 or later

Affected configurations

Nvd

Vulners

Node

apachestreamparkRange<2.0.0

VendorProductVersionCPE
apachestreampark*cpe:2.3:a:apache:streampark:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
apache	streampark	*	cpe:2.3:a:apache:streampark::::::::

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Apache StreamPark (incubating)",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThan": "2.0.0",
        "status": "affected",
        "version": "1.0.0",
        "versionType": "custom"
      }
    ]
  }
]

References

lists.apache.org/thread/thwl1v2h6r3c21x1qwff08o57qzjnst6

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.4

Confidence

High

EPSS

0.005

Percentile

77.7%

JSON

Related for CVE-2022-45802