CVE-2024-29070

On versions before 2.1.4, session is not invalidated after logout. When the user logged in successfully, the Backend service returns "Authorization" as the front-end authentication credential. "Authorization" can still initiate requests and access data even after logout. Mitigation: all users should upgrade to 2.1.4

Score

CVSS 3.1 9.1 Critical

Status

Analyzed - security@apache.org

Published

2024-07-23

Last modified

2024-09-13

Weaknesses

CWE-613

Affected products

• Streampark (Apache)
• Apache Streampark (Apache Software Foundation)

References

• https://lists.apache.org/thread/zslblrz1l0n9t67mqdv42yv75ncfn9zl
• http://www.openwall.com/lists/oss-security/2024/07/22/4