CVE-2024-31979highCWE-918

CVE-2024-31979: fallo de gravedad alta en Apache StreamPipes

Apache StreamPipes: Possibility of SSRF in pipeline element installation process

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Apache StreamPipes+ Monitorear org.apache.streampipes:streampipes-parent

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7.5epss 0.7%
Server-Side Request Forgery (SSRF) vulnerability in Apache StreamPipes during installation process of pipeline elements. Previously, StreamPipes allowed users to configure custom endpoints from which to install additional pipeline elements. These endpoints were not properly validated, allowing an attacker to get StreamPipes to send an HTTP GET request to an arbitrary address. This issue affects Apache StreamPipes: through 0.93.0. Users are recommended to upgrade to version 0.95.0, which fixes the issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Productos afectados
Apache Software Foundation · Apache StreamPipes
CVEs relacionadas — Apache StreamPipes

En el mismo producto, de las más peligrosas a las menos.

CVE-2025-47411HIGHApache StreamPipes: Leverage of User ID for Privilege EscalationEPSS 15.3%CVE-2024-29868CRITICALApache StreamPipes, Apache StreamPipes: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in Recovery Token GenerationEPSS 6.0%CVE-2024-31411MEDIUMApache StreamPipes: Potential remote code execution (RCE) via file uploadEPSS 1.1%CVE-2023-31469HIGHApache StreamPipes: Privilege escalation through non-admin userEPSS 1.1%CVE-2024-24778MEDIUMApache StreamPipes: Resources Permission EscalationEPSS 0.7%CVE-2024-30471MEDIUMApache StreamPipes: Potential creation of multiple identical accountsEPSS 0.7%