Vulnerabilities > Apache > Streampark > Critical

DATE CVE VULNERABILITY TITLE RISK
2023-05-01 CVE-2022-46365 Unspecified vulnerability in Apache Streampark
Apache StreamPark 1.0.0 before 2.0.0 When the user successfully logs in, to modify his profile, the username will be passed to the server-layer as a parameter, but not verified whether the user name is the currently logged user and whether the user is legal, This will allow malicious attackers to send any username to modify and reset the account, Users of the affected versions should upgrade to Apache StreamPark 2.0.0 or later.
network
low complexity
apache
critical
9.1
2023-05-01 CVE-2022-45802 Unspecified vulnerability in Apache Streampark
Streampark allows any users to upload a jar as application, but there is no mandatory verification of the uploaded file type, causing users to upload some high-risk files, and may upload them to any directory, Users of the affected versions should upgrade to Apache StreamPark 2.0.0 or later
network
low complexity
apache
critical
9.8