PT-2024-22741 · Unknown · Streampark

L0Ne1Y · Published 2024-07-17 · Updated 2024-11-14 · CVE-2024-29120

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Streampark versions prior to 2.1.4

Description The issue allows a user to obtain sensitive information, including usernames, passwords, and salt values of other users, after a successful login. This is due to the Backend service returning "Authorization" as the front-end authentication credential.

Recommendations For versions prior to 2.1.4, upgrade to version 2.1.4 to resolve the issue.

Fix

Insecure Storage of Sensitive Information

Weakness Enumeration

CWE-922

CWE-212

Related Identifiers

CVE-2024-29120

GHSA-HCF8-5J78-887V

Affected Products

Streampark

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-29120 · Security Note
• https://osv.dev/vulnerability/GHSA-hcf8-5j78-887v · Vendor Advisory
• https://lists.apache.org/thread/y3oqz7l8vd7jxxx3z2khgl625nvfr60j · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-29120 · Vendor Advisory
• https://github.com/apache/incubator-streampark · Note
• https://t.me/cvedetector/1082 · Telegram Post
• http://openwall.com/lists/oss-security/2024/07/17/4 · Note