CVE-2022-46365
Last modified
CVE-2022-46365 is a critical-severity vulnerability rated 9.1/10 on the CVSS scale. Apache StreamPark 1.0.0 before 2.0.0 When the user successfully logs in, to modify his profile, the username will be passed to the server-layer as a parameter, but not verified whether the user name is the currently logged user and whether the user is legal, This will allow malicious attackers to send any username to modify and reset the account, Users of the affected versions should upgrade to Apache StreamPark 2.0.0 or later. . EPSS estimates a 1.47% chance of exploitation in the next 30 days.
Description
Apache StreamPark 1.0.0 before 2.0.0 When the user successfully logs in, to modify his profile, the username will be passed to the server-layer as a parameter, but not verified whether the user name is the currently logged user and whether the user is legal, This will allow malicious attackers to send any username to modify and reset the account, Users of the affected versions should upgrade to Apache StreamPark 2.0.0 or later.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Apache | Streampark | >= 1.0.0, < 2.0.0 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-46365?
How severe is CVE-2022-46365?
How do I fix CVE-2022-46365?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-46359Potential vulnerabilities have been identified in HP Securit…8.8
- CVE-2022-4636Black Box KVM Firmware version 3.4.31307 on models ACR1000A-…7.5
- CVE-2022-46360Out-of-bounds read vulnerability in V-SFT v6.1.7.0 and earli…7.8
- CVE-2022-46361An attacker having physical access to WDM can plug USB devic…6.8
- CVE-2022-46363A vulnerability in Apache CXF before versions 3.5.5 and 3.4.…7.5
- CVE-2022-46364A SSRF vulnerability in parsing the href attribute of XOP:In…9.8
- CVE-2022-46366Apache Tapestry 3.x allows deserialization of untrusted data…9.8
- CVE-2022-46367Rumpus - FTP server Cross-site request forgery (CSRF) – Priv…8.8
- CVE-2022-46368Rumpus - FTP server version 9.0.7.1 Cross-site request forge…8.8
- CVE-2022-46369Rumpus - FTP server version 9.0.7.1 Persistent cross-site sc…5.4
- CVE-2022-4637A vulnerability classified as problematic has been found in …6.1
- CVE-2022-46370Rumpus - FTP server version 9.0.7.1 Improper Token Verificat…7.5
Are you affected by CVE-2022-46365?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST