GHSA-vv8h-m63v-53pqHighCVSS 8.8

Apache StreamPark: FreeMarker SSTI RCE Vulnerability

Published
July 18, 2024
Last Modified
February 13, 2025

🔗 CVE IDs covered (1)

CVE-2024-29178 →

📋 Description

On versions before 2.1.4, a user could log in and perform a template injection attack resulting in Remote Code Execution on the server, The attacker must successfully log into the system to launch an attack, so this is a moderate-impact vulnerability.

Mitigation:

all users should upgrade to 2.1.4

🎯 Affected products1

  • maven/org.apache.streampark:streampark:< 2.1.4

🔗 References (4)