Non évaluée
Apache StreamPark: session not invalidated after logout
CVE-2024-29070
Première détection SecPulse
Description d'origine La description telle que publiée par la source (souvent en anglais).
On versions before 2.1.4, session is not invalidated after logout. When the user logged in successfully, the Backend service returns "Authorization" as the front-end authentication credential. "Authorization" can still initiate requests and access data even after logout.
Mitigation:
all users should upgrade to 2.1.4
Références
- advisory github.com
- advisory lists.apache.org
- advisory nvd.nist.gov
- web openwall.com