{"cve":"CVE-2022-46365","nvd":{"published":"2023-05-01T15:15:09.013","modified":"2026-06-17T05:11:38.120","status":"Modified","description":"Apache StreamPark 1.0.0 before 2.0.0 When the user successfully logs in, to modify his profile, the username will be passed to the server-layer as a parameter, but not verified whether the user name is the currently logged user and whether the user is legal, This will allow malicious attackers to send any username to modify and reset the account, Users of the affected versions should upgrade to Apache StreamPark 2.0.0 or later.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","score":9.1},"cwes":["CWE-20"],"references":["https://lists.apache.org/thread/f68lcwrp8pcdc4yrbpcm8j7m0f5mjn7h","https://lists.apache.org/thread/f68lcwrp8pcdc4yrbpcm8j7m0f5mjn7h"],"products":["apache:streampark"],"source":"nvd","synced_at":"2026-10-19T21:38:05.473481323+00:00"},"epss":{"cve":"CVE-2022-46365","score":0.01475,"percentile":0.7383,"date":"2026-11-01"},"kev":null,"osv":[{"id":"GHSA-m5h8-2pjw-vg3j","url":"https://osv.dev/vulnerability/GHSA-m5h8-2pjw-vg3j","summary":"Apache StreamPark Improper Input Validation vulnerability","modified":"2023-11-08T04:10:56.373Z","packages":[{"ecosystem":"Maven","name":"org.apache.streampark:streampark","purl":"pkg:maven/org.apache.streampark/streampark","ranges":[">=1.0.0 <2.0.0"],"fixed":["2.0.0"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}