CVE-2024-34457

{"id": "CVE-2024-34457", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2024-07-22T10:15:03.607", "references": [{"url": "https://lists.apache.org/thread/brlfrmvw9dcv38zoofmhxg7qookmwn7j", "tags": ["Mailing List", "Vendor Advisory"], "source": "security@apache.org"}, {"url": "https://www.openwall.com/lists/oss-security/2024/07/22/2", "source": "security@apache.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-639"}]}, {"type": "Secondary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-639"}]}], "descriptions": [{"lang": "en", "value": "On versions before 2.1.4, after a regular user successfully logs in, they can manually make a request using the authorization token to view everyone's user flink information, including executeSQL and config.\n\nMitigation:\n\nall users should upgrade to 2.1.4"}, {"lang": "es", "value": "En versiones anteriores a la 2.1.4, despu\u00e9s de que un usuario normal inicia sesi\u00f3n con \u00e9xito, puede realizar una solicitud manualmente utilizando el token de autorizaci\u00f3n para ver la informaci\u00f3n de flink de todos los usuarios, incluidos runSQL y config. Mitigaci\u00f3n: todos los usuarios deben actualizar a 2.1.4"}], "lastModified": "2024-11-04T22:35:05.480", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:streampark:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "43F40411-3380-4B0F-BA0D-18C85BD8C615", "versionEndExcluding": "2.1.4"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}