CVE-2024-29070 — Apache StreamPark: session not invalidated after logout

Description (CNA)

On versions before 2.1.4, session is not invalidated after logout. When the user logged in successfully, the Backend service returns "Authorization" as the front-end authentication credential. "Authorization" can still initiate requests and access data even after logout. Mitigation: all users should upgrade to 2.1.4

Affected (CNA)

Vendor / product	Versions
Apache Software Foundation / Apache StreamPark	affected 1.0.0 before 2.1.4

CWE

CWE-613

References

https://lists.apache.org/thread/zslblrz1l0n9t67mqdv42yv75ncfn9zl

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

CVE

No English description supplied.

https://lists.apache.org/thread/zslblrz1l0n9t67mqdv42yv75ncfn9zl
http://www.openwall.com/lists/oss-security/2024/07/22/4