CVE-2024-29070: Apache StreamPark: session not invalidated after logout
On versions before 2.1.4, session is not invalidated after logout. When the user logged in successfully, the Backend service returns "Authorization" as the front-end authentication credential. "Authorization" can still initiate requests and access data even after logout.
Mitigation:
all users should upgrade to 2.1.4
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-29070?
CVE-2024-29070 has been classified as a high severity vulnerability due to the risk of unauthorized data access after logout.
How do I fix CVE-2024-29070?
To fix CVE-2024-29070, upgrade to Apache StreamPark version 2.1.4 or later, where session invalidation on logout is properly implemented.
What versions are affected by CVE-2024-29070?
CVE-2024-29070 affects all versions of Apache StreamPark prior to 2.1.4.
What kind of attacks can CVE-2024-29070 facilitate?
CVE-2024-29070 can facilitate unauthorized access attacks, allowing users to continue accessing data after they have logged out.
Is user data at risk due to CVE-2024-29070?
Yes, user data may be at risk due to CVE-2024-29070, as the vulnerability allows unauthorized access to data even after a user has logged out.