CVE-2024-31411
Apache StreamPipes: Potential remote code execution (RCE) via file upload
- State
- Published
- Severity
- 6.0 Medium
- Published
- Jul 17, 2024
- Updated
- Sep 13, 2024
- Reserved
- Apr 3, 2024
Description
Unrestricted Upload of File with dangerous type vulnerability in Apache StreamPipes. Such a dangerous type might be an executable file that may lead to a remote code execution (RCE). The unrestricted upload is only possible for authenticated and authorized users. This issue affects Apache StreamPipes: through 0.93.0.
Users are recommended to upgrade to version 0.95.0, which fixes the issue.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 6.0 Medium | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:L | CISA-ADP |
Weaknesses
- CWE-434 Unrestricted Upload of File with Dangerous Type
Affected Products
| Product | Versions |
|---|---|
Apache StreamPipesApache Software Foundation |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.