Unrated
Apache StreamPark: session not invalidated after logout
CVE-2024-29070
First seen on SecPulse
Original description The description as published by the source.
On versions before 2.1.4, session is not invalidated after logout. When the user logged in successfully, the Backend service returns "Authorization" as the front-end authentication credential. "Authorization" can still initiate requests and access data even after logout.
Mitigation:
all users should upgrade to 2.1.4
References
- advisory github.com
- advisory lists.apache.org
- advisory nvd.nist.gov
- web openwall.com