Apache StreamPark (incubating): Logic error causing any account reset
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub.
Summary
Apache StreamPark 1.0.0 before 2.0.0 When the user successfully logs in, to modify his profile, the username will be passed to the server-layer as a parameter, but not verified whether the user name is the currently logged user and whether the user is legal, This will allow malicious attackers to send any username to modify and reset the account, Users of the affected versions should upgrade to Apache StreamPark 2.0.0 or later.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache StreamPark (incubating) | 1.0.0 to before 2.0.0 | 2.0.0 | Patch available | CNA |
| — | org.apache.streampark:streampark (Maven) | 1.0.0 to before 2.0.0 | 2.0.0 | Patch available | GHSA-m5h8-2pjw-vg3j |
- Apache StreamPark (incubating) VendorApache Affected 1.0.0 to before 2.0.0 Fixed in 2.0.0 Patch available CNA
- org.apache.streampark:streampark (Maven) Vendor— Affected 1.0.0 to before 2.0.0 Fixed in 2.0.0 Patch available GHSA-m5h8-2pjw-vg3j
Remediation
- Fix · CNA Apache StreamPark (incubating) (Apache Software Foundation) Fixed in 2.0.0
- Fix · GHSA-m5h8-2pjw-vg3j org.apache.streampark:streampark (Maven) Fixed in 2.0.0 Advisory →
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Apache StreamPark (incubating) 2.0.0
3 records Highest priority Priority MEDIUM 2 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2022-22606 Apache StreamPark (incubating): Upload any file to any directoryPriority MEDIUM 51
- TI-2022-22605 Apache StreamPark (incubating): LDAP Injection VulnerabilityPriority LOW 27
Timeline
- 2026-10-02 Threatist record created from CVE-2022-46365
- 2026-10-03 Alias added: GHSA-m5h8-2pjw-vg3j
References
Advisory 2
Other 5
- https://github.com/apache/incubator-streampark/pull/2123
- https://github.com/apache/incubator-streampark/commit/4f39d7f422d7519a3febc2d15d31ed0126d54fbc
- https://github.com/apache/incubator-streampark
- https://github.com/apache/incubator-streampark/blob/dev/streampark-console/streampark-console-service/src/main/java/org/apache/streampark/console/system/controller/UserController.java#L128
- https://github.com/apache/incubator-streampark/blob/dev/streampark-console/streampark-console-service/src/main/java/org/apache/streampark/console/system/service/impl/UserServiceImpl.java#L149-L162
More Apache Streampark vulnerabilities
- TI-2022-22606 Apache StreamPark (incubating): Upload any file to any directory CVSS 3.1CRITICAL 9.8
- TI-2025-34667 Apache StreamPark: Use hard-coded key vulnerability CVSS 3.1CRITICAL 9.8
- TI-2024-19248 Apache StreamPark: session not invalidated after logout CVSS 3.1CRITICAL 9.1
- TI-2024-19347 Apache StreamPark: FreeMarker SSTI RCE Vulnerability CVSS 3.1HIGH 8.8
- TI-2023-28690 Apache StreamPark (incubating): Unchecked maven build params could trigger remote command execution CVSS 3.1HIGH 8.8
- TI-2024-19513 Apache StreamPark (incubating): maven build params could trigger remote command execution CVSS 3.1HIGH 8.8
Sources
- CVE-2022-46365 · CVE Program
- CVE-2022-46365 · NVD
- FIRST EPSS
- GHSA-m5h8-2pjw-vg3j · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences