| Package | Affected versions | Patched versions |
|---|---|---|
| org.apache.streampark:streampark-common_2.11 | < 2.0.0 | 2.0.0 |
| org.apache.streampark:streampark-common_2.12 | < 2.0.0 | 2.0.0 |
| streampark | < 2.0.0 | 2.0.0 |
Streampark allows any users to upload a jar as application, but there is no mandatory verification of the uploaded file type. This means users may upload some high-risk files, and may upload them to any directory. Users of the affected versions should upgrade to Apache StreamPark 2.0.0 or later.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free