CVE-2022-45802

Description

Streampark allows any users to upload a jar as application, but there is no mandatory verification of the uploaded file type, causing users to upload some high-risk files, and may upload them to any directory, Users of the affected versions should upgrade to Apache StreamPark 2.0.0 or later

Reserved 2022-11-23 | Published 2023-05-01 | Updated 2024-10-21 | Assigner apache

Problem types

CWE-434 Unrestricted Upload of File with Dangerous Type

Product status

Default status
unaffected

1.0.0 before 2.0.0
affected

References

lists.apache.org/thread/thwl1v2h6r3c21x1qwff08o57qzjnst6 vendor-advisory

cve.org (CVE-2022-45802)

nvd.nist.gov (CVE-2022-45802)

Download JSON