« Volver al listado

CVE-2023-30867

Estado: ModificadaMedia (4.9)—

In the Streampark platform, when users log in to the system and use certain features, some pages provide a name-based fuzzy search, such as job names, role names, etc. The sql syntax :select * from table where jobName like '%jobName%'. However, the jobName field may receive illegal parameters, leading to SQL injection. This could potentially result in information leakage.

Mitigation:

Users are recommended to upgrade to version 2.1.2, which fixes the issue.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Apache — Streampark

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-30867",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.9,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 1.2
      }
    ]
  },
  "affected": [
    {
      "source": "security@apache.org",
      "affectedData": [
        {
          "vendor": "Apache Software Foundation",
          "product": "Apache StreamPark (incubating)",
          "versions": [
            {
              "status": "affected",
              "version": "2.0.0",
              "lessThan": "2.1.2",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2023-12-15T13:15:07.223",
  "references": [
    {
      "url": "https://lists.apache.org/thread/bhdzh6hnh04yyf3g203bbyvxryd720o2",
      "tags": [
        "Mailing List",
        "Vendor Advisory"
      ],
      "source": "security@apache.org"
    },
    {
      "url": "https://lists.apache.org/thread/bhdzh6hnh04yyf3g203bbyvxryd720o2",
      "tags": [
        "Mailing List",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@apache.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Streampark platform, when users log in to the system and use certain features, some pages provide a name-based fuzzy search, such as job names, role names, etc. The sql syntax :select * from table where jobName like '%jobName%'. However, the jobName field may receive illegal parameters, leading to SQL injection. This could potentially result in information leakage.\n\nMitigation:\n\nUsers are recommended to upgrade to version 2.1.2, which fixes the issue.\n\n"
    },
    {
      "lang": "es",
      "value": "En la plataforma Streampark, cuando los usuarios inician sesión en el sistema y utilizan ciertas funciones, algunas páginas proporcionan una búsqueda difusa basada en nombres, como nombres de trabajos, nombres de funciones, etc. La sintaxis SQL: select* de la tabla donde '%jobName%' gusta. Sin embargo, el campo jobName puede recibir parámetros no válidos, lo que provocará una inyección de SQL. Esto podría resultar potencialmente en una fuga de información. Mitigación: se recomienda a los usuarios actualizar a la versión 2.1.2, que soluciona el problema."
    }
  ],
  "lastModified": "2026-06-17T05:55:48.863",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apache:streampark:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A5A4CCCF-F382-4FF8-AB13-9BE1B2B9757B",
              "versionEndExcluding": "2.1.2",
              "versionStartIncluding": "2.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@apache.org"
}