CVE-2024-29178highCWE-94

CVE-2024-29178: fallo de gravedad alta en Apache StreamPark

Apache StreamPark: FreeMarker SSTI RCE Vulnerability

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Apache StreamPark+ Monitorear org.apache.streampark:streampark

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 8.8epss 1.2%
On versions before 2.1.4, a user could log in and perform a template injection attack resulting in Remote Code Execution on the server, The attacker must successfully log into the system to launch an attack, so this is a moderate-impact vulnerability. Mitigation: all users should upgrade to 2.1.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Productos afectados
Apache Software Foundation · Apache StreamPark
CVEs relacionadas — Apache StreamPark

En el mismo producto, de las más peligrosas a las menos.

CVE-2024-29070CRITICALApache StreamPark: session not invalidated after logoutEPSS 0.8%CVE-2024-34457MEDIUMApache StreamPark IDOR VulnerabilityEPSS 0.7%CVE-2024-48988HIGHApache StreamPark: SQL injection vulnerabilityEPSS 0.6%CVE-2025-30001HIGHApache StreamPark: Authenticated users can trigger remote command executionEPSS 0.6%CVE-2025-54947MEDIUMApache StreamPark: Use hard-coded key vulnerabilityEPSS 0.5%CVE-2024-29120MEDIUMApache StreamPark: Information leakage vulnerabilityEPSS 0.3%