CVE-2024-29178 Apache StreamPark: FreeMarker SSTI RCE Vulnerability

2024-07-1811:15:56

CWE-94

apache

www.cve.org

cve-2024-29178

apache streampark

freemarker

ssti

rce

vulnerability

code execution

mitigation

upgrade

EPSS

0.002

Percentile

57.1%

JSON

On versions before 2.1.4, a user could log in and perform a template injection attack resulting in Remote Code Execution on the server, The attacker must successfully log into the system to launch an attack, so this is a moderate-impact vulnerability.

Mitigation:

all users should upgrade to 2.1.4

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Apache StreamPark",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThan": "2.1.4",
        "status": "affected",
        "version": "1.0.0",
        "versionType": "semver"
      }
    ]
  }
]