CVE-2024-34457

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

On versions before 2.1.4, after a regular user successfully logs in, they can manually make a request using the authorization token to view everyone's user flink information, including executeSQL and config.

Mitigation:

all users should upgrade to 2.1.4

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-639

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache StreamPark	>= 1.0.0, < 2.1.4

References

https://lists.apache.org/thread/brlfrmvw9dcv38zoofmhxg7qookmwn7jMailing List, Vendor Advisory
https://www.openwall.com/lists/oss-security/2024/07/22/2
http://www.openwall.com/lists/oss-security/2024/07/22/2
https://lists.apache.org/thread/brlfrmvw9dcv38zoofmhxg7qookmwn7jMailing List, Vendor Advisory

Timeline

Published: Jul 22, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-344587.5Keyfactor Command 10.5.x before 10.5.1 and 11.5.x before 11.5.1 allows SQL Injection which could result in information disclosure.CVE-2024-344597.5An issue was discovered in xmllint (from libxml2) before 2.11.8 and 2.12.x before 2.12.7. Formatting error messages with xmllint --htmlout c CVE-2024-34468.2A double free vulnerability was found in QEMU virtio devices (virtio-gpu, virtio-serial-bus, virtio-crypto), where the mem_reentrancy_guard CVE-2024-344606.5The Tree Explorer tool from Organizer in Zenario before 9.5.60602 is affected by XSS. (This component was removed in 9.5.60602.)CVE-2024-344619.8Zenario before 9.5.60437 uses Twig filters insecurely in the Twig Snippet plugin, and in the site-wide HEAD and BODY elements, enabling code CVE-2024-344626.1Alinto SOGo through 5.10.0 allows XSS during attachment preview.CVE-2024-344635.1BPL Personal Weighing Scale PWS-01BT IND/09/18/599 devices send sensitive information in unencrypted BLE packets. (The packet data also lack CVE-2024-344676.1ThinkPHP 8.0.3 allows remote attackers to exploit XSS due to inadequate filtering of function argument values in think_exception.tpl.CVE-2024-344686.1Rukovoditel before 3.5.3 allows XSS via user_photo to My Page.CVE-2024-344697.1Rukovoditel before 3.5.3 allows XSS via user_photo to index.php?module=users/registration&action=save.CVE-2024-34476.0A heap-based buffer overflow was found in the SDHCI device emulation of QEMU. The bug is triggered when both `s->data_count` and the size of CVE-2024-344708.6An issue was discovered in HSC Mailinspector 5.2.17-3 through v.5.2.18. An Unauthenticated Path Traversal vulnerability exists in the /publi