CVE-2024-31979
published 2024-07-17CVE-2024-31979: Server-Side Request Forgery (SSRF) vulnerability in Apache StreamPipes during installation process of pipeline elements. Previously, StreamPipes allowed users…
PriorityP426medium4.3CVSS 3.1
AVNACLPRLUINSUCNILAN
EPSS
0.74%
50.2th percentile
Server-Side Request Forgery (SSRF) vulnerability in Apache StreamPipes during installation process of pipeline elements.
Previously, StreamPipes allowed users to configure custom endpoints from which to install additional pipeline elements.
These endpoints were not properly validated, allowing an attacker to get StreamPipes to send an HTTP GET request to an arbitrary address.
This issue affects Apache StreamPipes: through 0.93.0.
Users are recommended to upgrade to version 0.95.0, which fixes the issue.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | streampipes | < 0.95.0 | 0.95.0 |
| apache | streampipes | >= 0 < 0.95.0 | 0.95.0 |
| apache_software_foundation | apache_streampipes | <= 0.93.0 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2024-31979: Server-Side Request Forgery (SSRF) vulnerability in Apache StreamPipes during installation process of pipeline elements
osv·2024-07-17
CVE-2024-31979 CVE-2024-31979: Server-Side Request Forgery (SSRF) vulnerability in Apache StreamPipes during installation process of pipeline elements
Server-Side Request Forgery (SSRF) vulnerability in Apache StreamPipes during installation process of pipeline elements.
Previously, StreamPipes allowed users to configure custom endpoints from which to install additional pipeline elements.
These endpoints were not properly validated, allowing an attacker to get StreamPipes to send an HTTP GET request to an arbitrary address.
This issue affects Apache StreamPipes: through 0.93.0.
Users are recommended to upgrade to version 0.95.0, which fixes the issue.
OSV
Apache StreamPipes has possibility of SSRF in pipeline element installation process
osv·2024-07-17
CVE-2024-31979 [MEDIUM] Apache StreamPipes has possibility of SSRF in pipeline element installation process
Apache StreamPipes has possibility of SSRF in pipeline element installation process
Server-Side Request Forgery (SSRF) vulnerability in Apache StreamPipes during installation process of pipeline elements.
Previously, StreamPipes allowed users to configure custom endpoints from which to install additional pipeline elements.
These endpoints were not properly validated, allowing an attacker to get StreamPipes to send an HTTP GET request to an arbitrary address.
This issue affects Apache StreamPipes: through 0.93.0.
Users are recommended to upgrade to version 0.95.0, which fixes the issue.
GHSA
Apache StreamPipes has possibility of SSRF in pipeline element installation process
ghsa·2024-07-17
CVE-2024-31979 [MEDIUM] CWE-918 Apache StreamPipes has possibility of SSRF in pipeline element installation process
Apache StreamPipes has possibility of SSRF in pipeline element installation process
Server-Side Request Forgery (SSRF) vulnerability in Apache StreamPipes during installation process of pipeline elements.
Previously, StreamPipes allowed users to configure custom endpoints from which to install additional pipeline elements.
These endpoints were not properly validated, allowing an attacker to get StreamPipes to send an HTTP GET request to an arbitrary address.
This issue affects Apache StreamPipes: through 0.93.0.
Users are recommended to upgrade to version 0.95.0, which fixes the issue.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-07-17
Published