CVE-2023-49898

CVE-2023-49898 concerns Apache StreamPark: a project module that integrates Maven compilation lacks validation of Maven parameters, allowing remote command execution. The advisory notes that an attacker must be an authenticated system user with high privileges, limiting exposure, and that the ove...

CVE-2023-30867

CVE-2023-30867 (Apache StreamPark) : The vulnerability arises in the StreamPark platform’s name-based fuzzy search (e.g., jobName or roleName) where input used in a LIKE '%…%' clause is not validated, enabling SQL injection. Multiple sources (NVD, Red Hat, CNVD, Veracode, OSV, GHSA, CVE list) con...

CVE-2023-52291

The Apache StreamPark development and management environment contains a command injection vulnerability in its Project module . The root cause is lax input parameter validation, specifically the incorrect handling of the < operator within Maven build arguments. An attacker with system-level pr...

CVE-2024-29120

In Apache StreamPark (versions prior to 2.1.4 ), an information disclosure vulnerability exists because the Backend service incorrectly returns "Authorization" as the front-end authentication credential upon a successful login. An attacker can leverage this credential to request sensitive informa...

CVE-2024-34457

CVE-2024-34457 affects Apache StreamPark versions prior to 2.1.4. After a regular user logs in, an attacker can manually issue a request with a valid authorization token to view all users’ flink information, including sensitive fields like executeSQL and config . Root cause described as a privile...

CVE-2022-45802

CVE-2022-45802 (Apache StreamPark) : The vulnerability stems from a lack of mandatory verification of uploaded files when users submit jars as applications, which can permit uploading high-risk files and potentially placing them in arbitrary directories. This aligns with reported path traversal c...

CVE-2024-29737

Apache StreamPark versions prior to 2.1.4 are vulnerable to a command injection flaw in the Project Module . The root cause is the incorrect processing and lack of strict validation for the backtick (`) character within Maven build parameters. An authenticated attacker with system-level permissio...

CVE-2024-29070

Apache StreamPark versions prior to 2.1.4 are vulnerable to an improper session management flaw where sessions are not invalidated after a user logs out. The backend service provides an Authorization credential upon successful login that remains valid, allowing an attacker to bypass security rest...

CVE-2023-52290

Apache StreamPark (specifically streampark-console ) is vulnerable to SQL injection in its list pages, such as the application pages. The root cause is the lack of validation for the sort field sent from the front-end to the back-end, which is used directly to generate SQL queries. An attacker mu...

CVE-2022-45801

CVE-2022-45801 concerns Apache StreamPark versions 1.0.0–2.0.0 with an LDAP injection vulnerability. The issue arises when user input is not properly sanitized, allowing LDAP statements to be modified similarly to SQL Injection. Documented impact includes potential unauthorized access permissions...

CVE-2025-53960

Apache StreamPark (versions 2.0.0 through 2.1.6 ) is vulnerable to a security bypass because it uses weak encryption keys, specifically utilizing the user's password as the HMAC signing key for JSON Web Tokens (e.g., with the HS256 algorithm). An attacker can exploit this by performing offline br...

CVE-2024-29178

Apache StreamPark before version 2.1.4 is affected by a FreeMarker SSTI vulnerability that an authenticated user can exploit to achieve Remote Code Execution on the server. Root cause: template injection via FreeMarker in the application, with high impact (CVE-2024-29178). Remediation: upgrade to...

CVE-2022-46365

CVE-2022-46365 affects Apache StreamPark 1.0.0 before 2.0.0. The issue is an improper username verification when a user modifies their profile: the username is passed to the server without confirming the user is the currently logged-in one. This can allow an attacker to supply any username to mod...

CVE-2025-30001

Apache StreamPark, a streaming media application development framework, is vulnerable to an Incorrect Execution-Assigned Permissions issue in versions 2.1.4 through 2.1.5 . This vulnerability allows authenticated users to trigger remote command execution , which could lead to compromised confiden...

CVE-2024-48988

A SQL Injection vulnerability exists in Apache StreamPark versions 2.1.4 through 2.1.5 (specifically the SpringBoot platform distribution package, not Maven artifacts). The root cause is a lack of validation for externally entered SQL statements, which could allow an attacker to execute illegal c...

CVE-2025-54947

Apache StreamPark versions 2.0.0–2.1.7 contain a hard-coded, immutable encryption key, enabling potential decryption/ forgery of encrypted data and unauthorized access. The issue arises from using a fixed key instead of a dynamically generated or securely configured one. Upgrade to 2.1.7 is recom...

CVE-2025-54981

CVE-2025-54981 affects Apache StreamPark prior to 2.1.7, due to use of AES in ECB mode and a weak RNG for encrypting sensitive data such as JWT tokens. This weak encryption could lead to exposure of confidential data. The vulnerability is documented across multiple sources (NVD, Red Hat, OSV, CNV...