CVE-2024-30471

Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache StreamPipes in user self-registration. This allows an attacker to potentially request the creation of multiple accounts with the same email address until the email address is registered, creating many identical users and corrupting StreamPipe's user management. This issue affects Apache StreamPipes: through 0.93.0. Users are recommended to upgrade to version 0.95.0, which fixes the issue.

CVSS v3 3.7 LOW

3.7^/10

CVSS v3 : LOW

Vector :

Exploitability : 2.2 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://lists.apache.org/thread/8yodrmohgcybq900or3d4hc1msl230fr	Mailing List Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:streampipes:*:*:*:*:*:*:*:*

History

25 Jul 2024, 13:39

Type	Values Removed	Values Added
Summary		(es) Vulnerabilidad de condición de ejecución de tiempo de verificación de tiempo de uso (TOCTOU) en Apache StreamPipes en el registro automático del usuario. Esto permite que un atacante solicite potencialmente la creación de varias cuentas con la misma dirección de correo electrónico hasta que se registre la dirección de correo electrónico, lo que crea muchos usuarios idénticos y corrompe la administración de usuarios de StreamPipe. Este problema afecta a Apache StreamPipes: hasta 0.93.0. Se recomienda a los usuarios actualizar a la versión 0.95.0, que soluciona el problema.
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 3.7
First Time		Apache streampipes Apache
CPE		cpe:2.3:a:apache:streampipes::::::::
References	~~() https://lists.apache.org/thread/8yodrmohgcybq900or3d4hc1msl230fr -~~	() https://lists.apache.org/thread/8yodrmohgcybq900or3d4hc1msl230fr - Mailing List, Vendor Advisory

17 Jul 2024, 09:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-07-17 09:15

Updated : 2024-08-01 13:50

NVD link : CVE-2024-30471

Mitre link : CVE-2024-30471

CVE.ORG link : CVE-2024-30471

JSON object : View

Products Affected

apache

streampipes

CWE

CWE-367

Time-of-check Time-of-use (TOCTOU) Race Condition

{"id": "CVE-2024-30471", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.2}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2024-07-17T09:15:02.640", "references": [{"url": "https://lists.apache.org/thread/8yodrmohgcybq900or3d4hc1msl230fr", "tags": ["Mailing List", "Vendor Advisory"], "source": "security@apache.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-367"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-367"}]}], "descriptions": [{"lang": "en", "value": "Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache StreamPipes in user self-registration.\nThis allows an attacker to potentially request the creation of multiple accounts with the same email address until the email address is registered, creating many identical users and corrupting StreamPipe's user management.\nThis issue affects Apache StreamPipes: through 0.93.0.\n\nUsers are recommended to upgrade to version 0.95.0, which fixes the issue.\n\n"}, {"lang": "es", "value": "Vulnerabilidad de condici\u00f3n de ejecuci\u00f3n de tiempo de verificaci\u00f3n de tiempo de uso (TOCTOU) en Apache StreamPipes en el registro autom\u00e1tico del usuario. Esto permite que un atacante solicite potencialmente la creaci\u00f3n de varias cuentas con la misma direcci\u00f3n de correo electr\u00f3nico hasta que se registre la direcci\u00f3n de correo electr\u00f3nico, lo que crea muchos usuarios id\u00e9nticos y corrompe la administraci\u00f3n de usuarios de StreamPipe. Este problema afecta a Apache StreamPipes: hasta 0.93.0. Se recomienda a los usuarios actualizar a la versi\u00f3n 0.95.0, que soluciona el problema."}], "lastModified": "2024-08-01T13:50:08.403", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:streampipes:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B5EC9EC8-4988-4DAC-A92F-CCDED7F9CB52", "versionEndExcluding": "0.95.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}