WaratekVRT Sign in

Apache StreamPipes CVEs

7 CVEs

Reset
More filters (2)
Columns
Vendor apache✕Product streampipes✕
Overview 7 matches · 0 protected · 0 exploited · 0 CISA KEV · 1 public PoC · 0 EPSS ≥ 0.5
7matches 0protected0.0% 0exploited0.0% 0CISA KEV0.0% 1public PoC14.3% 0EPSS ≥ 0.50.0%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 1 14.3% No exploit published 6 85.7%
Critical 1 14.3% High 4 57.1% Medium 2 28.6% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 7 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 1 14.3% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 6 85.7%
split by peak 3 / quarter
No exploit published: 6Mitigation candidate: 1 Medium: 2High: 4Critical: 1 not blocked: 7 No public exploit: 6Working exploit published: 1
Q2 231 No exploit published1 High1 not blocked1 No public exploit1 Q3 230 Q4 230 Q1 240 Q2 241 Mitigation candidate1 Critical1 not blocked1 Working exploit published1 Q3 243 No exploit published3 High2 Medium1 not blocked3 No public exploit3 Q4 240 Q1 251 No exploit published1 Medium1 not blocked1 No public exploit1 Q2 250 Q3 250 Q4 250 Q1 261 No exploit published1 High1 not blocked1 No public exploit1
Q2 23Q3 23Q4 23Q1 24Q2 24Q3 24Q4 24Q1 25Q2 25Q3 25Q4 25Q1 26
7 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2025-47411 High 2026-01-01 No exploit published No public exploit A user with a legitimate non-administrator account can exploit a vulnerability in the user ID creation mechanism in Apache StreamPipes that allows them to swap the username of an existing user with that of an administrator.  This vulnerability allows an attacker to gain administrative control over the application by manipulating JWT tokens, which can lead to data tampering, unauthorized access and other security issues. This issue affects Apache StreamPipes: through 0.97.0. Users are recommended to upgrade to version 0.98.0, which fixes the issue.
CVE-2024-24778 Medium 2025-03-03 No exploit published No public exploit Improper privilege management in a REST interface allowed registered users to access unauthorized resources if the resource ID was know. This issue affects Apache StreamPipes: through 0.95.1. Users are recommended to upgrade to version 0.97.0 which fixes the issue.
CVE-2024-31979 High 2024-07-17 No exploit published No public exploit Server-Side Request Forgery (SSRF) vulnerability in Apache StreamPipes during installation process of pipeline elements. Previously, StreamPipes allowed users to configure custom endpoints from which to install additional pipeline elements. These endpoints were not properly validated, allowing an attacker to get StreamPipes to send an HTTP GET request to an arbitrary address. This issue affects Apache StreamPipes: through 0.93.0. Users are recommended to upgrade to version 0.95.0, which fixes the issue.
CVE-2024-31411 High 2024-07-17 No exploit published No public exploit Unrestricted Upload of File with dangerous type vulnerability in Apache StreamPipes. Such a dangerous type might be an executable file that may lead to a remote code execution (RCE). The unrestricted upload is only possible for authenticated and authorized users. This issue affects Apache StreamPipes: through 0.93.0. Users are recommended to upgrade to version 0.95.0, which fixes the issue.
CVE-2024-30471 Medium 2024-07-17 No exploit published No public exploit Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache StreamPipes in user self-registration. This allows an attacker to potentially request the creation of multiple accounts with the same email address until the email address is registered, creating many identical users and corrupting StreamPipe's user management. This issue affects Apache StreamPipes: through 0.93.0. Users are recommended to upgrade to version 0.95.0, which fixes the issue.
CVE-2024-29868 Critical 2024-06-24 Mitigation candidate Working exploit published Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) vulnerability in Apache StreamPipes user self-registration and password recovery mechanism. This allows an attacker to guess the recovery token in a reasonable time and thereby to take over the attacked user's account. This issue affects Apache StreamPipes: from 0.69.0 through 0.93.0. Users are recommended to upgrade to version 0.95.0, which fixes the issue.
CVE-2023-31469 High 2023-06-23 No exploit published No public exploit A REST interface in Apache StreamPipes (versions 0.69.0 to 0.91.0) was not properly restricted to admin-only access. This allowed a non-admin user with valid login credentials to elevate privileges beyond the initially assigned roles. The issue is resolved by upgrading to StreamPipes 0.92.0.