PT-2024-22741

CVE-2024-29120

Published

2024-07-17

Updated

2024-11-14

Description by

CVSS 3.1

5.9

Medium

MetricsAV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Streampark versions prior to 2.1.4

Description The issue allows a user to obtain sensitive information, including usernames, passwords, and salt values of other users, after a successful login. This is due to the Backend service returning "Authorization" as the front-end authentication credential.

Recommendations For versions prior to 2.1.4, upgrade to version 2.1.4 to resolve the issue.

Exploitability

Exploit

Fix

Impacts

Researchers

L0Ne1Y

Vendors

Affected products

Weakness enumeration

CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer

CWE-922: Insecure Storage of Sensitive Information