Apache StreamPipes has potential remote code execution (RCE) via file upload

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2024-31411 · ADVISORY
• apache/streampipes · PACKAGE
• apache/streampipes release release/0.95.0 · WEB
• pypa/advisory-database · WEB
• lists.apache.org/thread/b0657okbwzg5xxs11hphvc9qrd9s70mt · WEB
• openwall.com/lists/oss-security/2024/07/16/10 · WEB
• GitHub Advisory GHSA-6523-jf4r-c962 · ADVISORY

org.apache.streampipes:streampipes-parent のその他の脆弱性

• CVE-2025-47411高 8.1A user with a legitimate non-administrator account can exploit a vulnerability in the user ID creation mechanism in Apache StreamPipes that …
• CVE-2024-24778中 6.5Improper privilege management in a REST interface allowed registered users to access unauthorized resources if the resource ID was know. …
• CVE-2024-31979中 4.3Server-Side Request Forgery (SSRF) vulnerability in Apache StreamPipes during installation process of pipeline elements. Previously, StreamP…
• CVE-2024-30471低 3.7Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache StreamPipes in user self-registration. This allows an attacker to …
• CVE-2023-31469高 8.8 A REST interface in Apache StreamPipes (versions 0.69.0 to 0.91.0) was not properly restricted to admin-only access. This allowed a non-adm…