CVE-2024-29178
HIGHProduct <2.1.4 - RCE
Title source: llmDescription
On versions before 2.1.4, a user could log in and perform a template injection attack resulting in Remote Code Execution on the server, The attacker must successfully log into the system to launch an attack, so this is a moderate-impact vulnerability. Mitigation: all users should upgrade to 2.1.4
Scores
CVSS v3
8.8
EPSS
0.1202
EPSS Percentile
93.7%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Classification
CWE
CWE-94
Status
published
Affected Products (2)
apache/streampark
< 2.1.4
org.apache.streampark/streampark
< 2.1.4Maven
Timeline
Published
Jul 18, 2024
Tracked Since
Feb 18, 2026