GitHub Advisoryadvisory · Maven, PyPI

GHSA-9gr7-gh74-qg9x Apache StreamPipes has possibility of SSRF in pipeline element installation process

MEDIUM Published 2024-07-17 Modified 2025-01-21 Official page ↗
Aliases
CVE-2024-31979
Ecosystem
Maven, PyPI
Packages
org.apache.streampipes:streampipes-parent, streampipes
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-918
Reviewed
2024-07-18

Affected packages

• Maven org.apache.streampipes:streampipes-parent: < 0.95.0 → fixed in 0.95.0 • PyPI streampipes: < 0.95.0 → fixed in 0.95.0

Description

Server-Side Request Forgery (SSRF) vulnerability in Apache StreamPipes during installation process of pipeline elements. Previously, StreamPipes allowed users to configure custom endpoints from which to install additional pipeline elements. These endpoints were not properly validated, allowing an attacker to get StreamPipes to send an HTTP GET request to an arbitrary address. This issue affects Apache StreamPipes: through 0.93.0. Users are recommended to upgrade to version 0.95.0, which fixes the issue.

Related

Alias · CVE (1)

  • CVE-2024-31979 Server-Side Request Forgery (SSRF) vulnerability in Apache StreamPipes during installation process of pipeline elements. vulnerability

Weakness · CWE (1)

  • CWE-918 Server-Side Request Forgery weakness

References