Authorization Credential Leak in Streampark
CVE-2024-29120

5.9MEDIUM

Key Information:

Vendor
Apache
Status
Apache Streampark
Vendor
CVE Published:
17 July 2024

Summary

In Streampark (version < 2.1.4), when a user logged in successfully, the Backend service would return "Authorization" as the front-end authentication credential. User can use this credential to request other users' information, including the administrator's username, password, salt value, etc. 

Mitigation:

all users should upgrade to 2.1.4

Affected Version(s)

Apache StreamPark 2.0.0 < 2.1.4

References

https://lists.apache.org/thread/y3oqz7l8vd7jxxx3z2khgl625...
vendor-advisory
http://www.openwall.com/lists/oss-security/2024/07/17/4

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

L0ne1y
.