Apache Streampark (Apache Software Foundation) - vulnerabilities (CVEs)

9 CVEs, 0 in the last 30 days, 2 known versions, newest CVE from 2025-12-12. Vendor: Apache Software Foundation.

CVEs of Apache Streampark

CVE-2025-53960 - CVSS 5.9 (medium), 2025-12-12: When issuing JSON Web Tokens (JWT), Apache StreamPark directly uses the user's password as the HMAC signing key (e.g., with the HS256 algorithm). An attacker…
CVE-2025-54981 - CVSS 7.5 (high), 2025-12-12: Weak Encryption Algorithm in StreamPark, The use of an AES cipher in ECB mode and a weak random number generator for encrypting sensitive data, including JWT…
CVE-2025-54947 - CVSS 9.8 (critical), 2025-12-12: In Apache StreamPark versions 2.0.0 through 2.1.7, a security vulnerability involving a hard-coded encryption key exists. This vulnerability occurs because…
CVE-2025-30001 - CVSS 7.3 (high), 2025-10-10: Incorrect Execution-Assigned Permissions vulnerability in Apache StreamPark. This issue affects Apache StreamPark: from 2.1.4 before 2.1.6. Users are…
CVE-2024-48988 - CVSS 7.6 (high), 2025-08-22: SQL Injection vulnerability in Apache StreamPark. This issue affects Apache StreamPark: from 2.1.4 before 2.1.6. Users are recommended to upgrade to version…
CVE-2024-29070 - CVSS 9.1 (critical), 2024-07-23: On versions before 2.1.4, session is not invalidated after logout. When the user logged in successfully, the Backend service returns "Authorization" as the…
CVE-2024-34457 - CVSS 6.5 (medium), 2024-07-22: On versions before 2.1.4, after a regular user successfully logs in, they can manually make a request using the authorization token to view everyone's user…
CVE-2024-29178 - CVSS 8.8 (high), 2024-07-18: On versions before 2.1.4, a user could log in and perform a template injection attack resulting in Remote Code Execution on the server, The attacker must…
CVE-2024-29120 - CVSS 5.9 (medium), 2024-07-17: In Streampark (version < 2.1.4), when a user logged in successfully, the Backend service would return "Authorization" as the front-end authentication…