GitHub Advisoryadvisory · Maven, PyPI

GHSA-6523-jf4r-c962 Apache StreamPipes has potential remote code execution (RCE) via file upload

HIGH Published 2024-07-17 Modified 2025-01-21 Official page ↗
Aliases
CVE-2024-31411
Ecosystem
Maven, PyPI
Packages
org.apache.streampipes:streampipes-parent, streampipes
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-434
Reviewed
2024-07-18

Affected packages

• Maven org.apache.streampipes:streampipes-parent: < 0.95.0 → fixed in 0.95.0 • PyPI streampipes: < 0.95.0 → fixed in 0.95.0

Description

Unrestricted Upload of File with dangerous type vulnerability in Apache StreamPipes. Such a dangerous type might be an executable file that may lead to a remote code execution (RCE). The unrestricted upload is only possible for authenticated and authorized users. This issue affects Apache StreamPipes: through 0.93.0. Users are recommended to upgrade to version 0.95.0, which fixes the issue.

Related

Alias · CVE (1)

  • CVE-2024-31411 Unrestricted Upload of File with dangerous type vulnerability in Apache StreamPipes. vulnerability

Weakness · CWE (1)

  • CWE-434 Unrestricted Upload of File with Dangerous Type weakness

References