CVE-2025-54947
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-12-12

Last updated on: 2025-12-15

Assigner: Apache Software Foundation

Description
In Apache StreamPark versions 2.0.0 through 2.1.7, a security vulnerability involving a hard-coded encryption key exists. This vulnerability occurs because the system uses a fixed, immutable key for encryption instead of dynamically generating or securely configuring the key. Attackers may obtain this key through reverse engineering or code analysis, potentially decrypting sensitive data or forging encrypted information, leading to information disclosure or unauthorized system access. This issue affects Apache StreamPark: from 2.0.0 before 2.1.7. Users are recommended to upgrade to version 2.1.7, which fixes the issue.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-12-12
Last Modified
2025-12-15
Generated
2026-06-16
AI Q&A
2025-12-12
EPSS Evaluated
2026-06-15
NVD
CVE-2025-54947
EUVD
EUVD-2025-203084
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
apache streampark From 2.0.0 (inc) to 2.1.7 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-321 The product uses a hard-coded, unchangeable cryptographic key.
CWE-798 The product contains hard-coded credentials, such as a password or cryptographic key.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability in Apache StreamPark versions 2.0.0 through 2.1.7 involves the use of a hard-coded encryption key. Instead of generating or securely configuring encryption keys dynamically, the system uses a fixed, immutable key. Attackers can potentially obtain this key through reverse engineering or code analysis, which allows them to decrypt sensitive data or forge encrypted information.

Impact Analysis

The vulnerability can lead to information disclosure or unauthorized system access because attackers who obtain the hard-coded encryption key can decrypt sensitive data or create forged encrypted information.

Mitigation Strategies

Upgrade Apache StreamPark to version 2.1.7 or later, as this version fixes the hard-coded encryption key vulnerability.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-54947. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart