CVE-2022-46365 json
Apache StreamPark (incubating): Logic error causing any account reset
published 2023-05-01 3 y ago modified 2026-06-17 4 mo ago also GHSA-m5h8-2pjw-vg3j , EUVD-2023-2094
- cvss
- 9.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.5%
- EPSS 1.5% chance of exploitation in 30 days, percentile 74%
- public exploits
- 0
- none known
Summary
Apache StreamPark 1.0.0 before 2.0.0 When the user successfully logs in, to modify his profile, the username will be passed to the server-layer as a parameter, but not verified whether the user name is the currently logged user and whether the user is legal, This will allow malicious attackers to send any username to modify and reset the account, Users of the affected versions should upgrade to Apache StreamPark 2.0.0 or later.
Patch / fix
- maven org.apache.streampark:streampark 2.0.0
- Apache Software Foundation Apache StreamPark (incubating) 2.0.0
- apache streampark 2.0.0
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
1.47% chance of exploitation in the next 30 days, higher than 74% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 9.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H |
| NVD | 3.1 | 9.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H |
| CNA | 3.1 | 9.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H |
| GitHub | 3.1 | 9.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.apache.streampark:streampark | >=1.0.0, <2.0.0 |
2.0.0 |
Affected products
- Apache Software Foundation Apache StreamPark (incubating)
- apache streampark
Classification
- Weakness
-
- CWE-20 Improper Input Validation
References
-
github.com
/apache/incubator-streampark/pull/2123
web
-
github.com
/apache/incubator-streampark/commit/4f39d7f422d7519a3febc2d15d31ed0126d54fbc
web
-
lists.apache.org
/thread/f68lcwrp8pcdc4yrbpcm8j7m0f5mjn7h
vendor-advisory, web, mailing-list
-
nvd.nist.gov
/vuln/detail/CVE-2022-46365
advisory
-
github.com
/apache/incubator-streampark
package
-
github.com
/apache/incubator-streampark/blob/dev/streampark-console/streampark-console-service/src/main/java/org/apache/s
web
-
github.com
/apache/incubator-streampark/blob/dev/streampark-console/streampark-console-service/src/main/java/org/apache/s
web
Sources
- CVE List CVE-2022-46365
- GitHub Advisory GHSA-m5h8-2pjw-vg3j
- NVD CVE-2022-46365
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.