Apache StreamPark contains an Incorrect Execution-Assigned Permissions vulnerability

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2025-30001 · ADVISORY
• apache/streampark · PACKAGE
• lists.apache.org/thread/xfmsvhkcnr1831n0w5ovy3p44lsmfb7m · WEB
• openwall.com/lists/oss-security/2025/09/04/1 · WEB

org.apache.streampark:streampark のその他の脆弱性

• CVE-2025-53960中 5.9When issuing JSON Web Tokens (JWT), Apache StreamPark directly uses the user's password as the HMAC signing key (e.g., with the HS256 algori…
• CVE-2025-54981高 7.5Weak Encryption Algorithm in StreamPark, The use of an AES cipher in ECB mode and a weak random number generator for encrypting sensitive da…
• CVE-2025-54947緊急 9.8In Apache StreamPark versions 2.0.0 through 2.1.7, a security vulnerability involving a hard-coded encryption key exists. This vulnerability…
• CVE-2024-29178高 8.8On versions before 2.1.4, a user could log in and perform a template injection attack resulting in Remote Code Execution on the server, The …
• CVE-2024-29120中 5.9In Streampark (version < 2.1.4), when a user logged in successfully, the Backend service would return "Authorization" as the front-end authe…