GitHub Advisoryadvisory · Maven

GHSA-pm73-x2h5-cmj3 Apache StreamPipes Improper Privilege Management vulnerability

HIGH Published 2023-06-23 Modified 2023-07-05 Official page ↗
Aliases
CVE-2023-31469
Ecosystem
Maven
Packages
org.apache.streampipes:streampipes-parent
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-269
Reviewed
2023-06-23

Affected packages

• Maven org.apache.streampipes:streampipes-parent: >= 0.69.0, < 0.92.0 → fixed in 0.92.0

Description

A REST interface in Apache StreamPipes (versions 0.69.0 to 0.91.0) was not properly restricted to admin-only access. This allowed a non-admin user with valid login credentials to elevate privileges beyond the initially assigned roles. The issue is resolved by upgrading to StreamPipes 0.92.0.

Related

Alias · CVE (1)

  • CVE-2023-31469 A REST interface in Apache StreamPipes (versions 0.69.0 to 0.91.0) was not properly restricted to admin-only access. vulnerability

Weakness · CWE (1)

  • CWE-269 Improper Privilege Management weakness

References