CVE-2024-29070

—

CVSS 3.1

9.1 critical

EPSS

<1%p54

Published

Jul 23, 2024 (Jul 23, 2024)

Modified

Jun 17, 2026

Description

On versions before 2.1.4, session is not invalidated after logout. When the user logged in successfully, the Backend service returns "Authorization" as the front-end authentication credential. "Authorization" can still initiate requests and access data even after logout. Mitigation: all users should upgrade to 2.1.4

Vendors: apache
Products: streampark
Weakness: CWE-613
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

NVD CVE.org GitHub PoCs EPSS (0.8%)

In the news0 stories

No ingested article mentions this CVE yet.