CVE-2024-34457 Apache StreamPark IDOR Vulnerability

2024-07-2209:48:23

CWE-639

apache

www.cve.org

cve-2024

apache streampark

idor vulnerability

authorization token

user flink information

executesql

config

mitigation

upgrade

EPSS

0.001

Percentile

29.2%

JSON

On versions before 2.1.4, after a regular user successfully logs in, they can manually make a request using the authorization token to view everyone’s user flink information, including executeSQL and config.

Mitigation:

all users should upgrade to 2.1.4

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Apache StreamPark",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThan": "2.1.4",
        "status": "affected",
        "version": "1.0.0",
        "versionType": "semver"
      }
    ]
  }
]