CVE-2024-29070criticalCWE-613

CVE-2024-29070: critical vulnerability in Apache StreamPark

Apache StreamPark: session not invalidated after logout

Published · Updated

Follow this CVE+ Monitor Apache StreamPark

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.1epss 0.8%
On versions before 2.1.4, session is not invalidated after logout. When the user logged in successfully, the Backend service returns "Authorization" as the front-end authentication credential. "Authorization" can still initiate requests and access data even after logout. Mitigation: all users should upgrade to 2.1.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Affected products
Apache Software Foundation · Apache StreamPark
Related CVEs — Apache StreamPark

In the same product, most dangerous first.

CVE-2024-29178HIGHApache StreamPark: FreeMarker SSTI RCE VulnerabilityEPSS 1.2%CVE-2024-34457MEDIUMApache StreamPark IDOR VulnerabilityEPSS 0.7%CVE-2024-48988HIGHApache StreamPark: SQL injection vulnerabilityEPSS 0.6%CVE-2025-30001HIGHApache StreamPark: Authenticated users can trigger remote command executionEPSS 0.6%CVE-2025-54947MEDIUMApache StreamPark: Use hard-coded key vulnerabilityEPSS 0.5%CVE-2024-29120MEDIUMApache StreamPark: Information leakage vulnerabilityEPSS 0.3%