Apache StreamPark 1.0.0 before 2.0.0 When the user successfully logs in, to modify his profile, the username will be passed to the server-layer as a parameter, but not verified whether the user name is the currently logged user and whether the user is legal, This will allow malicious attackers to send any username to modify and reset the account, Users of the affected versions should upgrade to Apache StreamPark 2.0.0 or later.
References
Link | Resource |
---|---|
https://lists.apache.org/thread/f68lcwrp8pcdc4yrbpcm8j7m0f5mjn7h | Mailing List |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: apache
Published: 2023-05-01T14:53:50.130Z
Updated: 2023-05-01T14:53:50.130Z
Reserved: 2022-12-02T08:52:04.022Z
Link: CVE-2022-46365
JSON object: View
NVD Information
Status : Analyzed
Published: 2023-05-01T15:15:09.013
Modified: 2023-05-09T18:04:19.747
Link: CVE-2022-46365
JSON object: View
Redhat Information
No data.
CWE