MavenPackage

org.apache.streampark:streampark

12 known vulnerabilities (1 critical, 5 high, 3 medium, 2 low), with the versions each affects and the releases that fix them.

Latest release: Not known: cve.now hasn't read this package's releases
Newest unaffected release: Not known without release data
Advisories: 12 · 1 critical, 5 high, 3 medium, 2 low

Dependents: 0
Registry: Maven Central

Advisories 12

CVE-2025-53960Medium 5.9
Apache StreamPark: Uses the user’s password as the secret key
Affected: from 2.0.0, fixed in 2.1.7.
CVE-2025-54947Medium 5.3
Apache StreamPark: Use hard-coded key vulnerability
Affected: from 2.0.0, fixed in 2.1.7.
CVE-2025-54981High 7.5
Apache StreamPark: Weak Encryption Algorithm in StreamPark
Affected: from 2.0.0, fixed in 2.1.7.
CVE-2025-30001High 7.3
Apache StreamPark: Authenticated users can trigger remote command execution
Affected: through 2.1.5.
CVE-2024-29178High 8.8
Apache StreamPark: FreeMarker SSTI RCE Vulnerability
Affected: fixed in 2.1.4.
CVE-2024-29120Medium 5.9
Apache StreamPark: Information leakage vulnerability
Affected: from 2.0.0, fixed in 2.1.4.
CVE-2024-29737High 8.8
Apache StreamPark (incubating): maven build params could trigger remote command execution
Affected: fixed in 2.1.4.
CVE-2023-52291High 8.8
Apache StreamPark (incubating): Unchecked maven build params could trigger remote command execution
Affected: fixed in 2.1.4.
CVE-2023-30867Low
Apache StreamPark (incubating): Authenticated system users could trigger SQL injection vulnerability
Affected: from 2.0.0, fixed in 2.1.2.
CVE-2023-49898Low
Apache StreamPark (incubating): Authenticated system users could trigger remote command execution
Affected: from 2.0.0, fixed in 2.1.2.
CVE-2022-46365Critical 9.1
Apache StreamPark (incubating): Logic error causing any account reset
Affected: from 1.0.0, fixed in 2.0.0.
CVE-2022-45801Unrated
Apache StreamPark (incubating): LDAP Injection Vulnerability
Affected: from 1.0.0, fixed in 2.0.0.