PT-2024-23092 · Apache · Apache Streampipes

Alessandro Albani · CVE-2024-29868 · Published 2024-06-22 · Updated 2025-07-15

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Apache StreamPipes versions 0.69.0 through 0.93.0

Description The issue is related to the use of a cryptographically weak pseudo-random number generator (PRNG) in the user self-registration and password recovery mechanism. This allows an attacker to guess the recovery token in a reasonable time, potentially leading to account takeover.

Recommendations For Apache StreamPipes versions 0.69.0 through 0.93.0, upgrade to version 0.95.0, which fixes the issue.

Exploit

Fix

Weakness Enumeration

CWE-338

Related Identifiers

CVE-2024-29868

GHSA-CF3Q-VG8W-MW84

Affected Products

Apache Streampipes

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/29xxx/CVE-2024-29868.json · Exploit
• https://osv.dev/vulnerability/CVE-2024-29868 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-29868 · Security Note
• https://osv.dev/vulnerability/GHSA-cf3q-vg8w-mw84 · Vendor Advisory
• https://lists.apache.org/thread/g7t7zctvq2fysrw1x17flnc12592nhx7 · Vendor Advisory
• https://github.com/apache/streampipes · Note
• https://github.com/apache/streampipes/commit/1d94191c49617dffbcb6f6d8fd73bcd5dd597d52 · Note
• https://t.me/cvenotify/84161 · Telegram Post
• https://t.me/pentestingnews/48439 · Telegram Post
• https://t.me/cvenotify/129037 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1804723946337517828 · Twitter Post
• http://openwall.com/lists/oss-security/2024/06/22/1 · Note
• https://twitter.com/oss_security/status/1804501916413558873 · Twitter Post