Description
A REST interface in Apache StreamPipes (versions 0.69.0 to 0.91.0) was not properly restricted to admin-only access. This allowed a non-admin user with valid login credentials to elevate privileges beyond the initially assigned roles. The issue is resolved by upgrading to StreamPipes 0.92.0.
Remediation
References
https://lists.apache.org/thread/c4y8kf9bzpf36v4bottfmd8tc9cxo19m
Related Vulnerabilities
CVE-2023-36471 Vulnerability in maven package org.xwiki.commons:xwiki-commons-xml
CVE-2020-11974 Vulnerability in maven package org.apache.dolphinscheduler:dolphinscheduler-dao
CVE-2023-50772 Vulnerability in maven package com.zintow:dingding-json-pusher
CVE-2022-36903 Vulnerability in maven package org.jenkins-ci.plugins:repository-connector
CVE-2022-0225 Vulnerability in maven package org.keycloak:keycloak-core