Apache StreamPipes has improper privilege management in a REST interface

Description

References

• nvd.nist.gov/vuln/detail/CVE-2024-24778 · ADVISORY
• apache/streampipes · PACKAGE
• pypa/advisory-database · WEB
• lists.apache.org/thread/j14w6wghlwwrgfgc6hoz9f94fwxtlgzh · WEB
• openwall.com/lists/oss-security/2025/03/03/1 · WEB
• GitHub Advisory GHSA-vm7w-2724-5m23 · ADVISORY

More vulnerabilities in org.apache.streampipes:streampipes-parent

• CVE-2025-47411HIGH 8.1A user with a legitimate non-administrator account can exploit a vulnerability in the user ID creation mechanism in Apache StreamPipes that …
• CVE-2024-31411HIGH 8.8Unrestricted Upload of File with dangerous type vulnerability in Apache StreamPipes. Such a dangerous type might be an executable file that …
• CVE-2024-31979MEDIUM 4.3Server-Side Request Forgery (SSRF) vulnerability in Apache StreamPipes during installation process of pipeline elements. Previously, StreamP…
• CVE-2024-30471LOW 3.7Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache StreamPipes in user self-registration. This allows an attacker to …
• CVE-2023-31469HIGH 8.8 A REST interface in Apache StreamPipes (versions 0.69.0 to 0.91.0) was not properly restricted to admin-only access. This allowed a non-adm…