Published: 22/07/2024 Updated: 21/11/2024

Unauthorized User Data Exposure via Token in Pre-2.1.4 Versions

In versions before 2.1.4, a regular user can log in and use the authorization token to request access to everyone's user flink information, like executeSQL and config. To fix this, users should upgrade to version 2.1.4.

Vulnerable Product	Search on Vulmon	Subscribe to Product
apache streampark

Severity: moderate Affected versions: - Apache StreamPark 100 before 214 Description: On versions before 214, after a regular user successfully logs in, they can manually make a request using the authorization token to view everyone's user flink information, including executeSQL and config Mitigation: all users should upgrade to 214 ...

CWE-639 CWE-639 https://nvd.nist.gov https://seclists.org/oss-sec/2024/q3/97 https://www.first.org/epss https://lists.apache.org/thread/brlfrmvw9dcv38zoofmhxg7qookmwn7j https://www.openwall.com/lists/oss-security/2024/07/22/2 http://www.openwall.com/lists/oss-security/2024/07/22/2 https://lists.apache.org/thread/brlfrmvw9dcv38zoofmhxg7qookmwn7j

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Product List Vendor List Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2024-34457

Vulnerability Summary

Mailing Lists

References

Vulmon Search

About

Products

Connect