Apache StreamPipes has possibility of SSRF in pipeline element installation process

Description

References

• nvd.nist.gov/vuln/detail/CVE-2024-31979 · ADVISORY
• apache/streampipes commit cd5a7b4 · WEB
• apache/streampipes · PACKAGE
• apache/streampipes release release/0.95.0 · WEB
• pypa/advisory-database · WEB
• lists.apache.org/thread/8lryp3bxnby9kmk13odkz2jbfdjfvf0y · WEB
• openwall.com/lists/oss-security/2024/07/16/11 · WEB
• GitHub Advisory GHSA-9gr7-gh74-qg9x · ADVISORY

More vulnerabilities in org.apache.streampipes:streampipes-parent

• CVE-2025-47411HIGH 8.1A user with a legitimate non-administrator account can exploit a vulnerability in the user ID creation mechanism in Apache StreamPipes that …
• CVE-2024-24778MEDIUM 6.5Improper privilege management in a REST interface allowed registered users to access unauthorized resources if the resource ID was know. …
• CVE-2024-31411HIGH 8.8Unrestricted Upload of File with dangerous type vulnerability in Apache StreamPipes. Such a dangerous type might be an executable file that …
• CVE-2024-30471LOW 3.7Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache StreamPipes in user self-registration. This allows an attacker to …
• CVE-2023-31469HIGH 8.8 A REST interface in Apache StreamPipes (versions 0.69.0 to 0.91.0) was not properly restricted to admin-only access. This allowed a non-adm…