Apache StreamPark 1.0.0 before 2.0.0 When the user successfully logs in, to modify his profile, the username will be passed to the server-layer as a parameter, but not verified whether the user name is the currently logged user and whether the user is legal, This will allow malicious attackers to send any username to modify and reset the account, Users of the affected versions should upgrade to Apache StreamPark 2.0.0 or later.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:HApache Streampark
APPApache1.0.0 – 2.0.0 (bez)
Related vulnerabilities
Apache StreamPark: zakodowany na stałe klucz szyfrowania (CVE-2025-54947)
Apache Streampark: sesja nie jest unieważniana po wylogowaniu
Streampark allows any users to upload a jar as application, but there is no mandatory verification of the uplo...
Weak Encryption Algorithm in StreamPark, The use of an AES cipher in ECB mode and a weak random number generat...
Incorrect Execution-Assigned Permissions vulnerability in Apache StreamPark. This issue affects Apache Stream...