CVE-2025-47411
BaseFortify
Publication date: 2026-01-01
Last updated on: 2026-01-06
Assigner: Apache Software Foundation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| apache | streampipes | From 0.69.0 (inc) to 0.98.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-269 | The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in Apache StreamPipes allows a legitimate non-administrator user to exploit a flaw in the user ID creation mechanism to swap their username with that of an administrator. By manipulating JSON Web Tokens (JWT), the attacker can gain administrative privileges within the application. [2]
How can this vulnerability impact me? :
The vulnerability can lead to unauthorized elevation of privileges, allowing attackers to gain administrative control. This can result in data tampering, unauthorized access to sensitive information, and other significant security risks within the application. [2]
What immediate steps should I take to mitigate this vulnerability?
Users are strongly advised to upgrade Apache StreamPipes to version 0.98.0, which fixes the vulnerability. This upgrade will prevent the privilege escalation caused by the user ID creation mechanism flaw. [2]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows unauthorized users to gain administrative control, potentially leading to data tampering and unauthorized access. Such security breaches can result in non-compliance with standards and regulations like GDPR and HIPAA, which require strict access controls and protection of sensitive data. Therefore, exploitation of this vulnerability could compromise compliance with these regulations. [2]