Read the docs
TI-2024-32663 Aliases CVE-2024-48988GHSA-6wpf-q5x2-66fc

Apache StreamPark: SQL injection vulnerability

Priority LOW 34CWE-564Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
SQL injection
Confidentiality · integrity · availability
High · Low · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-89.

Summary

SQL Injection vulnerability in Apache StreamPark. This issue affects Apache StreamPark: from 2.1.4 before 2.1.6. Users are recommended to upgrade to version 2.1.6, which fixes the issue. This vulnerability is present only in the distribution package (SpringBoot platform) and does not involve Maven artifacts. It can only be exploited after a user has successfully logged into the platform (implying that the attacker would first need to compromise the login authentication). As a result, the associated risk is considered relatively low.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00593 48th percentileScored 2026-11-07
Fix Fixed Apache StreamPark (Apache Software Foundation): 2.1.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache StreamPark2.1.4 to before 2.1.62.1.6Patch availableCNA
  • Apache StreamPark VendorApache Affected 2.1.4 to before 2.1.6 Fixed in 2.1.6 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:streampark:*:*:*:*:*:*:*:*2.1.4 to before 2.1.6VulnerableApache
  • cpe:2.3:a:apache:streampark:*:*:*:*:*:*:*:* Versions 2.1.4 to before 2.1.6 Vulnerable ·Apache

Remediation

  • Fix · CNA Apache StreamPark (Apache Software Foundation) Fixed in 2.1.6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-48988
  2. 2026-10-03 Alias added: GHSA-6wpf-q5x2-66fc

References

Advisory 1

  • TI-2022-22606 Apache StreamPark (incubating): Upload any file to any directory CVSS 3.1CRITICAL 9.8
  • TI-2025-34667 Apache StreamPark: Use hard-coded key vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2024-19248 Apache StreamPark: session not invalidated after logout CVSS 3.1CRITICAL 9.1
  • TI-2022-22908 Apache StreamPark (incubating): Logic error causing any account reset CVSS 3.1CRITICAL 9.1
  • TI-2024-19347 Apache StreamPark: FreeMarker SSTI RCE Vulnerability CVSS 3.1HIGH 8.8
  • TI-2023-28690 Apache StreamPark (incubating): Unchecked maven build params could trigger remote command execution CVSS 3.1HIGH 8.8
See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences