CVE-2024-24778

CVE-2024-24778: Apache StreamPipes: Resources Permission Escalation

Vendor Apache Software Foundation

Product Apache StreamPipes

Weakness CWE-269

Published March 3, 2025

Last update March 3, 2025

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

Improper privilege management in a REST interface allowed registered users to access unauthorized resources if the resource ID was know. This issue affects Apache StreamPipes: through 0.95.1. Users are recommended to upgrade to version 0.97.0 which fixes the issue.

Key dates

02Disclosure timeline

March 3, 2025 CVE published

March 3, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-24778 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/269.html AskarLabs — CWE-269 write-up Improper Privilege Management

Related vulnerabilities

04Related CVE

CVE-2026-4314 The Ultimate WordPress Toolkit – WP Extended <= 3.2.4 - Authenticated (Subscriber+) Privilege Escalation via Menu Editor Module CVE-2026-6895 Wishlist Member <= 3.30.1 - Missing Authorization to Authenticated (Subscriber+) API Secret Key Disclosure and Privilege Escalation via 'wlm3_export_settings' AJAX Action CVE-2026-75977 Mang Board WP <= 2.3.7 - Authenticated (Subscriber+) Privilege Escalation to Forged Authentication Cookie CVE-2026-2375 App Builder – Create Native Android & iOS Apps On The Flight <= 5.5.10 - Unauthenticated Privilege Escalation via 'role' Parameter CVE-2026-13439 Easy Form Builder by WhiteStudio <= 4.0.11 - Unauthenticated Privilege Escalation to Administrator via Password Recovery REST Endpoint