CVE-2024-31979
Last modified
CVE-2024-31979 is a medium-severity vulnerability rated 4.3/10 on the CVSS scale. Server-Side Request Forgery (SSRF) vulnerability in Apache StreamPipes during installation process of pipeline elements. Previously, StreamPipes allowed users to configure custom endpoints from which to install additional pipeline elements. These endpoints were not properly validated, allowing an attacker to get StreamPipes to send an HTTP GET request to an arbitrary address. This issue affects Apache StreamPipes: through 0.93.0. Users are recommended to upgrade to version 0.95.0, which fixes the issue. . EPSS estimates a 0.74% chance of exploitation in the next 30 days.
Description
Server-Side Request Forgery (SSRF) vulnerability in Apache StreamPipes during installation process of pipeline elements. Previously, StreamPipes allowed users to configure custom endpoints from which to install additional pipeline elements. These endpoints were not properly validated, allowing an attacker to get StreamPipes to send an HTTP GET request to an arbitrary address. This issue affects Apache StreamPipes: through 0.93.0. Users are recommended to upgrade to version 0.95.0, which fixes the issue.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Apache | Streampipes | < 0.95.0 |
References
- https://lists.apache.org/thread/8lryp3bxnby9kmk13odkz2jbfdjfvf0yMailing List, Vendor Advisory
- https://lists.apache.org/thread/8lryp3bxnby9kmk13odkz2jbfdjfvf0yMailing List, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2024-31979?
How severe is CVE-2024-31979?
How do I fix CVE-2024-31979?
How Strix Helps
- One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-31973Hitron CODA-4582 2AHKM-CODA4589 7.2.4.5.1b8 devices allow a …5.2
- CVE-2024-31974The com.solarized.firedown (aka Solarized FireDown Browser &…6.3
- CVE-2024-31975EnGenius EWS356-Fit devices through 1.1.30 allow a remote at…4.8
- CVE-2024-31976EnGenius EWS356-FIR 1.1.30 and earlier devices allow a remot…8
- CVE-2024-31977Adtran 834-5 11.1.0.101-202106231430, and fixed as of SmartO…8.8
- CVE-2024-31978A vulnerability has been identified in SINEC NMS (All versio…7.6
- CVE-2024-3198The WP Font Awesome Share Icons plugin for WordPress is vuln…6.4
- CVE-2024-31980A vulnerability has been identified in Parasolid V35.1 (All …7.8
- CVE-2024-31981XWiki Platform is a generic wiki platform. Starting in versi…8.8
- CVE-2024-31982XWiki Platform is a generic wiki platform. Starting in versi…9.8
- CVE-2024-31983XWiki Platform is a generic wiki platform. In multilingual w…8.8
- CVE-2024-31984XWiki Platform is a generic wiki platform. Starting in versi…8.8
Are you affected by CVE-2024-31979?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST