CVE-2025-47411

A vulnerability in the user ID creation mechanism of Apache StreamPipes (versions through 0.97.0 ) allows a user with a legitimate non-administrator account to perform a username swap with an administrator account. By manipulating JWT tokens , an attacker can gain full administrative control over...

CVE-2024-29868

Apache StreamPipes versions 0.69.0 through 0.93.0 are vulnerable to a cryptographically weak Pseudo-Random Number Generator (PRNG) in the user self-registration and password recovery mechanisms. An attacker can guess recovery tokens in a reasonable amount of time, potentially leading to unauthori...

CVE-2024-30471

A Time-of-check Time-of-use (TOCTOU) race condition vulnerability exists in the Self-Registration component of Apache StreamPipes (versions through 0.93.0 ). The root cause is insufficient synchronization when accessing a common resource during user registration. An attacker can exploit this by s...

CVE-2024-31411

CVE-2024-31411 concerns Apache StreamPipes, where an unrestricted upload of a dangerous file type is possible for authenticated/authorized users. The issue allows uploading potentially executable files, enabling remote code execution (RCE) on affected systems. Affected version: up to 0.93.0, with...

CVE-2023-31469

The CVE-2023-31469 issue affects Apache StreamPipes versions 0.69.0–0.91.0, where a REST interface was not properly restricted to administrator access. This allowed a non-admin user with valid credentials to elevate privileges beyond their roles. Red Hat and other sources corroborate an elevation...

CVE-2024-24778

Apache StreamPipes versions through 0.95.1 are vulnerable to improper privilege management in its REST interface. The root cause is a lack of filtering and sloppy validation of resource IDs, which allows registered users to access unauthorized resources if they know the specific resource ID. To r...

CVE-2024-31979

The org.apache.streampipes: streampipes-rest component in Apache StreamPipes is vulnerable to a Server-Side Request Forgery (SSRF) . The flaw occurs because custom endpoints used to install additional pipeline elements are not properly validated. An attacker can exploit this during the installati...