Authorization Credential Leak in Streampark
CVE-2024-29120

Currently unrated

Key Information:

Vendor
Apache
Status
Apache Streampark
Vendor
CVE Published:
17 July 2024

Summary

In Streampark (version < 2.1.4), when a user logged in successfully, the Backend service would return "Authorization" as the front-end authentication credential. User can use this credential to request other users' information, including the administrator's username, password, salt value, etc. 

Mitigation:

all users should upgrade to 2.1.4

Affected Version(s)

Apache StreamPark 2.0.0 < 2.1.4

References

https://lists.apache.org/thread/y3oqz7l8vd7jxxx3z2khgl625...
vendor-advisory
http://www.openwall.com/lists/oss-security/2024/07/17/4

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

L0ne1y
.