PT-2023-14915 · Apache · Apache Streampark

Huajie Wang · Publicado 2023-05-01 · Atualizado 2024-10-15 · CVE-2022-46365

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache StreamPark versions 1.0.0 through 1.0.0

Description The issue arises when a user successfully logs in and attempts to modify their profile. The username is passed to the server-layer as a parameter but is not verified to ensure it matches the currently logged-in user or if the user is legitimate. This oversight allows malicious attackers to send any username to modify and reset the account.

Recommendations For Apache StreamPark versions 1.0.0, upgrade to Apache StreamPark 2.0.0 or later.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2022-46365

GHSA-M5H8-2PJW-VG3J

Produtos afetados

Apache Streampark

Referências · 12

• https://github.com/apache/incubator-streampark · Nota
• https://github.com/apache/incubator-streampark/pull/2123 · Nota
• https://github.com/apache/incubator-streampark/commit/4f39d7f422d7519a3febc2d15d31ed0126d54fbc · Nota
• https://github.com/apache/incubator-streampark/blob/dev/streampark-console/streampark-console-service/src/main/java/org/apache/streampark/console/system/service/impl/UserServiceImpl.java#L149-L162 · Nota
• https://github.com/apache/incubator-streampark/blob/dev/streampark-console/streampark-console-service/src/main/java/org/apache/streampark/console/system/controller/UserController.java#L128 · Nota
• https://t.me/cvenotify/49552 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2022-46365 · Nota de Segurança
• https://lists.apache.org/thread/f68lcwrp8pcdc4yrbpcm8j7m0f5mjn7h · Aviso do Fabricante
• https://t.me/cvenotify/98141 · Publicação no Telegram
• https://osv.dev/vulnerability/GHSA-m5h8-2pjw-vg3j · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2022-46365 · Aviso do Fabricante
• https://t.me/cvenotify/49501 · Publicação no Telegram