[<prev] [next>] [day] [month] [year] [list]
Message-ID: <fc99feb6-aad8-ccd8-9001-42024fc36940@apache.org>
Date: Thu, 18 Jul 2024 10:11:22 +0000
From: Huajie Wang <benjobs@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2024-29178: Apache StreamPark: FreeMarker SSTI RCE
Vulnerability
Severity: moderate
Affected versions:
- Apache StreamPark 1.0.0 before 2.1.4
Description:
On versions before 2.1.4, a user could log in and perform a template injection attack resulting in Remote Code Execution on the server, The attacker must successfully log into the system to launch an attack, so this is a moderate-impact vulnerability.
Mitigation:
all users should upgrade to 2.1.4
Credit:
L0ne1y (reporter)
References:
https://streampark.incubator.apache.org
https://www.cve.org/CVERecord?id=CVE-2024-29178
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
