What is CVE-2024-48988?

CVE-2024-48988 is a high-severity vulnerability in Apache Streampark, classified under CWE-564. CVSS score: 7.6/10. Published 2025-08-22.

How severe is CVE-2024-48988?

High severity. CVSS v3 base score is 7.6 out of 10.

Is CVE-2024-48988 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

SQL Injection in Apache Streampark

CVE-2024-48988

SQL Injection vulnerability in Apache StreamPark. This issue affects Apache StreamPark: from 2.1.4 before 2.1.6. Users are recommended to upgrade to version 2.1.6, which fixes the issue. This vulnerability is present only in the distribution package (SpringBoot platform) and does not involve Maven artifacts. It can only be exploited after a user has successfully logged into the platform (implying that the attacker would first need to compromise the login authentication). As a result, the associated risk is considered relatively low.

EPSS: 0.006 (46.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.6 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L.

Affected products

Apache Streampark
Apache Software Foundation Streampark — versions 2.1.4

Weakness classification (CWE)

Public proof-of-concept exploits

fkie-cad/nvd-json-data-feeds

References

security@apache.org (vendor-advisory, Mailing List)
af854a3a-2127-422b-91ae-364da2661108

Frequently asked questions

What is CVE-2024-48988?: CVE-2024-48988 is a high-severity vulnerability in Apache Streampark, classified under CWE-564. CVSS score: 7.6/10. Published 2025-08-22.
How severe is CVE-2024-48988?: High severity. CVSS v3 base score is 7.6 out of 10.
Is CVE-2024-48988 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.