by Kastro
Paper/Archive/CVE-2022-46365

CVE-2022-46365

Apache Software Foundation Apache StreamPark (incubating) — Apache StreamPark (incubating): Logic error causing any account reset

EPSS 1%CVSS 9.1
critical.is priorityof 100
42
CVSS 9.1 (NVD, ADP agree)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 73.8.738 × 2014.8No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Apache StreamPark 1.0.0 before 2.0.0 When the user successfully logs in, to modify his profile, the username will be passed to the server-layer as a parameter, but not verified whether the user name is the currently logged user and whether the user is legal, This will allow malicious attackers to send any username to modify and reset the account, Users of the affected versions should upgrade to Apache StreamPark 2.0.0 or later.

Affected

ProductAffectedFixed inSource
Apache StreamPark (incubating)1.0.0 – < 2.0.02.0.0CNA
streampark1.0.0 – < 2.0.02.0.0CISA-ADP

Scores by source

CISA ADP9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

advisorylists.apache.org/thread/f68lcwrp8pcdc4yrbpcm8j7m0f5mjn7h