PT-2024-24331

CVE-2024-31979

Published

2024-07-17

Updated

2024-08-01

Description by

CVSS 3.1

7.5

High

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Apache StreamPipes versions through 0.93.0

Description A Server-Side Request Forgery (SSRF) issue exists in Apache StreamPipes during the installation process of pipeline elements. The software allowed users to configure custom endpoints for installing additional pipeline elements, but these endpoints were not properly validated. This allowed an attacker to get StreamPipes to send an HTTP GET request to an arbitrary address.

Recommendations For Apache StreamPipes versions through 0.93.0, upgrade to version 0.95.0, which fixes the issue.

Exploitability

Exploit

Fix

Impacts

Researchers

L0Ne1Y

Vendors

Affected products

Weakness enumeration

CWE-918: Server-Side Request Forgery (SSRF)

Related identifiers