CVE-2024-29868

CRITICAL NUCLEI LAB

Apache StreamPipes <0.95.0 - Info Disclosure

Title source: llm

Description

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) vulnerability in Apache StreamPipes user self-registration and password recovery mechanism. This allows an attacker to guess the recovery token in a reasonable time and thereby to take over the attacked user's account. This issue affects Apache StreamPipes: from 0.69.0 through 0.93.0. Users are recommended to upgrade to version 0.95.0, which fixes the issue.

Exploits (1)

nomisec WORKING POC 1 stars
by DEVisions · poc
https://github.com/DEVisions/CVE-2024-29868

Nuclei Templates (1)

Apache StreamPipes <= 0.93.0 - Use of Cryptographically Weak PRNG in Recovery Token Generation
CRITICALby Alessandro Albani - DEVisions
Shodan: http.title:"apache streampipes"
FOFA: title="apache streampipes"

References (2)

Scores

CVSS v3 9.1
EPSS 0.7844
EPSS Percentile 99.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Lab Environment

COMMUNITY
Community Lab
docker pull consul:1.14.3
docker pull couchdb:3.3.1
docker pull fogsyio/kafka:2.2.0
docker pull fogsyio/zookeeper:3.4.13
docker pull influxdb:2.6
+1 more images

Details

CWE
CWE-338
Status published
Products (2)
apache/streampipes 0.69.0 - 0.93.0
org.apache.streampipes/streampipes-resource-management 0.69.0 - 0.95.0Maven
Published Jun 24, 2024
Tracked Since Feb 18, 2026