CVE-2024-31411: Apache StreamPipes has potential remote code execution (RCE) via file upload
(updated )
Unrestricted Upload of File with dangerous type vulnerability in Apache StreamPipes. Such a dangerous type might be an executable file that may lead to a remote code execution (RCE). The unrestricted upload is only possible for authenticated and authorized users.
This issue affects Apache StreamPipes: through 0.93.0.
Users are recommended to upgrade to version 0.95.0, which fixes the issue.
References
- github.com/advisories/GHSA-6523-jf4r-c962
- github.com/apache/streampipes
- github.com/apache/streampipes/releases/tag/release%2F0.95.0
- github.com/pypa/advisory-database/tree/main/vulns/streampipes/PYSEC-2024-173.yaml
- lists.apache.org/thread/b0657okbwzg5xxs11hphvc9qrd9s70mt
- nvd.nist.gov/vuln/detail/CVE-2024-31411
Code Behaviors & Features
Detect and mitigate CVE-2024-31411 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →