CyberSec.Space Logo
Back to CVE Browser

CVE-2024-34457

MEDIUM
6.5
CVSS Severity Score
EPSS Score0.0000%
EPSS Percentile0.00th
Published2024-07-22
Last Modified2026-06-17
Data SourcesNVD

Vulnerability Description

On versions before 2.1.4, after a regular user successfully logs in, they can manually make a request using the authorization token to view everyone's user flink information, including executeSQL and config. Mitigation: all users should upgrade to 2.1.4

Affected Platforms (CPE)

📦
Apache

Streampark

< 2.1.4

References & Advisories

🔗 https://lists.apache.org/thread/brlfrmvw9dcv38zoofmhxg7qookmwn7j
🔗 https://www.openwall.com/lists/oss-security/2024/07/22/2
🔗 http://www.openwall.com/lists/oss-security/2024/07/22/2
🔗 https://lists.apache.org/thread/brlfrmvw9dcv38zoofmhxg7qookmwn7j

Related Vulnerabilities

CVE-2025-539605.9

When issuing JSON Web Tokens (JWT), Apache StreamPark directly uses the user's password as the HMAC signing key (e.g., with the HS...

CVE-2025-549817.5

Weak Encryption Algorithm in StreamPark, The use of an AES cipher in ECB mode and a weak random number generator for encrypting se...

CVE-2025-549479.8

In Apache StreamPark versions 2.0.0 through 2.1.7, a security vulnerability involving a hard-coded encryption key exists. This vul...

CVE-2025-300017.3

Incorrect Execution-Assigned Permissions vulnerability in Apache StreamPark. This issue affects Apache StreamPark: from 2.1.4 bef...