What is CVE-2022-46365?

CVE-2022-46365 is a critical-severity vulnerability in Apache Streampark, classified under Improper Input Validation. CVSS score: 9.1/10. Published 2023-05-01.

How severe is CVE-2022-46365?

Critical severity. CVSS v3 base score is 9.1 out of 10.

Improper input validation in Apache Streampark

CVE-2022-46365

Apache StreamPark 1.0.0 before 2.0.0 When the user successfully logs in, to modify his profile, the username will be passed to the server-layer as a parameter, but not verified whether the user name is the currently logged user and whether the user is legal, This will allow malicious attackers to send any username to modify and reset the account, Users of the affected versions should upgrade to Apache StreamPark 2.0.0 or later.

Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)

EPSS: 0.015 (71.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.1 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H.

Affected products

Apache Streampark
Apache Software Foundation Streampark (Incubating) — versions 1.0.0

Weakness classification (CWE)

CWE-20 — Improper Input Validation

References

security@apache.org (vendor-advisory, Mailing List)

Frequently asked questions

What is CVE-2022-46365?: CVE-2022-46365 is a critical-severity vulnerability in Apache Streampark, classified under Improper Input Validation. CVSS score: 9.1/10. Published 2023-05-01.
How severe is CVE-2022-46365?: Critical severity. CVSS v3 base score is 9.1 out of 10.