CVE-2024-29070

9.1 criticalEPSS 0.8%

Critical (9.1) in apache streampark. EPSS 0.8% chance of exploitation in the next 30 days.

On versions before 2.1.4, session is not invalidated after logout. When the user logged in successfully, the Backend service returns "Authorization" as the front-end authentication credential. "Authorization" can still initiate requests and access data even after logout. Mitigation: all users should upgrade to 2.1.4

Severity

CVSS 3.1

9.1 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

EPSS: 0.8% chance of exploitation in the next 30 days; higher than 56% of CVEs (scores of 2026-10-31)
CWE: CWE-613
Published: 2024-07-23
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

apache:streampark

References

https://lists.apache.org/thread/zslblrz1l0n9t67mqdv42yv75ncfn9zl
http://www.openwall.com/lists/oss-security/2024/07/22/4
https://lists.apache.org/thread/zslblrz1l0n9t67mqdv42yv75ncfn9zl

Check your stack JSON