PT-2023-14756 · Apache · Apache Streampark

Huajie Wang · Published 2023-05-01 · Updated 2024-10-21 · CVE-2022-45802

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache StreamPark versions prior to 2.0.0

Description The issue allows any user to upload a jar as an application without mandatory verification of the uploaded file type. This enables users to upload high-risk files and potentially upload them to any directory.

Recommendations For versions prior to 2.0.0, upgrade to Apache StreamPark 2.0.0 or later. As a temporary workaround, consider restricting the upload functionality to prevent users from uploading high-risk files until the issue is resolved.

Fix

Path traversal

Unrestricted File Upload

Weakness Enumeration

CWE-22

CWE-434

Related Identifiers

CVE-2022-45802

GHSA-6874-289G-F7H7

Affected Products

Apache Streampark

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2022-45802 · Security Note
• https://lists.apache.org/thread/thwl1v2h6r3c21x1qwff08o57qzjnst6 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6874-289g-f7h7 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-45802 · Vendor Advisory
• https://github.com/apache/incubator-streampark · Note
• https://github.com/apache/incubator-streampark/commit/0c87c6d8cf39ef2c31c1dea1a7df23d76f5e1236 · Note
• https://t.me/cvenotify/98961 · Telegram Post
• https://t.me/cvenotify/49502 · Telegram Post
• https://t.me/cvenotify/49553 · Telegram Post