CVE-2024-29868

CRITICAL NUCLEI

Apache StreamPipes <0.95.0 - Info Disclosure

Title source: llm

Description

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) vulnerability in Apache StreamPipes user self-registration and password recovery mechanism. This allows an attacker to guess the recovery token in a reasonable time and thereby to take over the attacked user's account. This issue affects Apache StreamPipes: from 0.69.0 through 0.93.0. Users are recommended to upgrade to version 0.95.0, which fixes the issue.

Exploits (1)

nomisec WORKING POC 1 stars
by DEVisions · poc
https://github.com/DEVisions/CVE-2024-29868

Nuclei Templates (1)

Apache StreamPipes <= 0.93.0 - Use of Cryptographically Weak PRNG in Recovery Token Generation
CRITICALby Alessandro Albani - DEVisions
Shodan: http.title:"apache streampipes"
FOFA: title="apache streampipes"

References (2)

Scores

CVSS v3 9.1
EPSS 0.7502
EPSS Percentile 98.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Classification

CWE
CWE-338
Status published

Affected Products (2)

apache/streampipes < 0.93.0
org.apache.streampipes/streampipes-resource-management < 0.95.0Maven

Timeline

Published Jun 24, 2024
Tracked Since Feb 18, 2026