CVE-2022-45802: falha crítica em Apache StreamPark (incubating)
Apache StreamPark (incubating): Upload any file to any directory
Publicada em · Atualizada em
Seguir esta CVE+ Monitorar Apache StreamPark+ Monitorar org.apache.streampark:streampark-common_2.11
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.8epss 1.3%
Streampark allows any users to upload a jar as application, but there is no mandatory verification of the uploaded file type, causing users to upload some high-risk files, and may upload them to any directory, Users of the affected versions should upgrade to Apache StreamPark 2.0.0 or later
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
Apache Software Foundation · Apache StreamPark (incubating)CVEs relacionadas — Apache StreamPark (incubating)
No mesmo produto, das mais perigosas para as menos.
CVE-2023-49898—Apache StreamPark (incubating): Authenticated system users could trigger remote command executionEPSS 2.3%CVE-2023-52291HIGHApache StreamPark (incubating): Unchecked maven build params could trigger remote command executionEPSS 1.6%CVE-2022-46365CRITICALApache StreamPark (incubating): Logic error causing any account resetEPSS 1.5%CVE-2024-29737HIGHApache StreamPark (incubating): maven build params could trigger remote command executionEPSS 1.1%CVE-2022-45801—Apache StreamPark (incubating): LDAP Injection VulnerabilityEPSS 1.1%CVE-2023-30867—Apache StreamPark (incubating): Authenticated system users could trigger SQL injection vulnerabilityEPSS 0.9%