CVE-2024-29070 Apache StreamPark: session not invalidated after logout

2024-07-2308:13:41

CWE-613

apache

github.com

cve-2024-29070

apache streampark

session invalidation

AI Score

Confidence

Low

EPSS

Percentile

9.4%

SSVC

Exploitation

none

Automatable

yes

Technical Impact

total

JSON

On versions before 2.1.4, session is not invalidated after logout. When the user logged in successfully, the Backend service returns “Authorization” as the front-end authentication credential. “Authorization” can still initiate requests and access data even after logout.

Mitigation:

all users should upgrade to 2.1.4

CNA Affected

[
  {
    "vendor": "Apache Software Foundation",
    "product": "Apache StreamPark",
    "versions": [
      {
        "status": "affected",
        "version": "1.0.0",
        "lessThan": "2.1.4",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:apache_software_foundation:apache_streampark:*:*:*:*:*:*:*:*"
    ],
    "vendor": "apache_software_foundation",
    "product": "apache_streampark",
    "versions": [
      {
        "status": "affected",
        "version": "1.0.0",
        "lessThan": "2.1.4",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]