CVE-2024-31979 — Server-Side Request Forgery in Apache Streampipes

CWE-918 — Server-Side Request Forgery5 documents4 sources
Severity
4.3MEDIUMNVD
EPSS
0.7%
top 27.71%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Apache StreampipesApache Software Foundation Apache Streampipes
Timeline
PublishedJul 17

Description

Server-Side Request Forgery (SSRF) vulnerability in Apache StreamPipes during installation process of pipeline elements. Previously, StreamPipes allowed users to configure custom endpoints from which to install additional pipeline elements. These endpoints were not properly validated, allowing an attacker to get StreamPipes to send an HTTP GET request to an arbitrary address. This issue affects Apache StreamPipes: through 0.93.0. Users are recommended to upgrade to version 0.95.0, which fixes t…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages3 packages

▶NVDapache/streampipes< 0.95.0
▶PyPIapache/streampipes< 0.95.0

🔴Vulnerability Details

4
CVEList
Apache StreamPipes: Possibility of SSRF in pipeline element installation process↗2024-07-17
▶
OSV
CVE-2024-31979: Server-Side Request Forgery (SSRF) vulnerability in Apache StreamPipes during installation process of pipeline elements↗2024-07-17
▶
OSV
Apache StreamPipes has possibility of SSRF in pipeline element installation process↗2024-07-17
▶
GHSA
Apache StreamPipes has possibility of SSRF in pipeline element installation process↗2024-07-17
▶
CVE-2024-31979 — Server-Side Request Forgery in Apache | cvebase