Vulnerability · Published Jul 23, 2024 · Assigned by apache
CVE-2024-29070Apache StreamPark: session not invalidated after logout
Critical 9.1
In plain English
A critical-severity security flaw in Apache StreamPark from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities).
Severity (CVSS 3.1)9.1Critical
Exploit odds (30 days)0.8%top 43.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
On versions before 2.1.4, session is not invalidated after logout. When the user logged in successfully, the Backend service returns "Authorization" as the front-end authentication credential. "Authorization" can still initiate requests and access data even after logout. Mitigation: all users should upgrade to 2.1.4
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache StreamPark | 1.0.0 – before 2.1.4 |
Weakness: CWE-613 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H