CVE-2022-46365 json
Apache StreamPark (incubating): Logic error causing any account reset
published 3y ago modified 4mo ago also GHSA-m5h8-2pjw-vg3j , EUVD-2023-2094
- cvss
- 9.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.5%
- EPSS 1.5% chance of exploitation in 30 days, percentile 74%
- public exploits
- 0
- none known
Summary
Apache StreamPark 1.0.0 before 2.0.0 When the user successfully logs in, to modify his profile, the username will be passed to the server-layer as a parameter, but not verified whether the user name is the currently logged user and whether the user is legal, This will allow malicious attackers to send any username to modify and reset the account, Users of the affected versions should upgrade to Apache StreamPark 2.0.0 or later.
Patch / fix
- maven org.apache.streampark:streampark 2.0.0
- Apache Software Foundation Apache StreamPark (incubating) 2.0.0
- apache streampark 2.0.0
Is CVE-2022-46365 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 2y ago
Exploit prediction
1.48% chance of exploitation in the next 30 days, higher than 74% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 9.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H |
| NVD | 3.1 | 9.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H |
| CNA | 3.1 | 9.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H |
| GitHub | 3.1 | 9.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.apache.streampark:streampark | >=1.0.0, <2.0.0 |
2.0.0 |
Affected products
- Apache Software Foundation Apache StreamPark (incubating)
- apache streampark
Classification
- Weakness
-
- CWE-20 Improper Input Validation
References
-
github.com
/apache/incubator-streampark/pull/2123
web
-
github.com
/apache/incubator-streampark/commit/4f39d7f422d7519a3febc2d15d31ed0126d54fbc
web
-
lists.apache.org
/thread/f68lcwrp8pcdc4yrbpcm8j7m0f5mjn7h
vendor-advisory, web, mailing-list
-
nvd.nist.gov
/vuln/detail/CVE-2022-46365
advisory
-
github.com
/apache/incubator-streampark
package
-
github.com
/apache/incubator-streampark/blob/dev/streampark-console/streampark-console-service/src/main/java/org/apache/s
web
-
github.com
/apache/incubator-streampark/blob/dev/streampark-console/streampark-console-service/src/main/java/org/apache/s
web
Sources
- CVE List CVE-2022-46365
- GitHub Advisory GHSA-m5h8-2pjw-vg3j
- NVD CVE-2022-46365
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.