{"id":"CVE-2023-31469","aliases":["EUVD-2023-1856","GHSA-pm73-x2h5-cmj3"],"status":"published","title":"Apache StreamPipes: Privilege escalation through non-admin user","description":"A REST interface in Apache StreamPipes (versions 0.69.0 to 0.91.0) was not properly restricted to admin-only access. This allowed a non-admin user with valid login credentials to elevate privileges beyond the initially assigned roles.\nThe issue is resolved by upgrading to StreamPipes 0.92.0.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01096,"percentile":0.65804,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-269"],"published":"2023-06-23T07:07:42Z","modified":"2026-10-28T02:30:33Z","fixes":[{"ecosystem":"Maven","package":"org.apache.streampipes:streampipes-parent","fixed_in":["0.92.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.streampipes:streampipes-parent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.69.0"},{"fixed":"0.92.0"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.apache.streampipes:streampipes-parent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.69.0"},{"fixed":"0.92.0"}]}],"versions":["0.69.0","0.70.0","0.90.0","0.91.0"]}],"products":[{"vendor":"apache","product":"streampipes"},{"vendor":"apache software foundation","product":"apache streampipes"}],"references":[{"url":"https://lists.apache.org/thread/c4y8kf9bzpf36v4bottfmd8tc9cxo19m","tags":["vendor-advisory","x_transferred","Mailing List","Vendor Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-31469","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-pm73-x2h5-cmj3"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/31xxx/CVE-2023-31469.json","tags":["advisory"]},{"url":"https://github.com/apache/streampipes","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2023-31469","title":"Apache StreamPipes: Privilege escalation through non-admin user","description":"\nA REST interface in Apache StreamPipes (versions 0.69.0 to 0.91.0) was not properly restricted to admin-only access. This allowed a non-admin user with valid login credentials to elevate privileges beyond the initially assigned roles.\nThe issue is resolved by upgrading to StreamPipes 0.92.0.\n\n","status":"published","published":"2023-06-23T07:07:42.875Z","modified":"2024-10-09T15:11:39.555Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T14:35:27.430605Z"}],"euvd":[{"id":"EUVD-2023-1856","description":"\nA REST interface in Apache StreamPipes (versions 0.69.0 to 0.91.0) was not properly restricted to admin-only access. This allowed a non-admin user with valid login credentials to elevate privileges beyond the initially assigned roles.\nThe issue is resolved by upgrading to StreamPipes 0.92.0.\n\n","status":"published","published":"2023-06-23T07:07:42Z","modified":"2024-10-09T15:11:39Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T00:27:43.39457Z"}],"ghsa":[{"id":"GHSA-pm73-x2h5-cmj3","title":"Apache StreamPipes Improper Privilege Management vulnerability","description":"A REST interface in Apache StreamPipes (versions 0.69.0 to 0.91.0) was not properly restricted to admin-only access. This allowed a non-admin user with valid login credentials to elevate privileges beyond the initially assigned roles.\nThe issue is resolved by upgrading to StreamPipes 0.92.0.\n\n","status":"published","published":"2023-06-23T09:30:17Z","modified":"2023-11-09T05:01:52Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T14:37:17.64478Z"}],"nvd":[{"id":"CVE-2023-31469","description":"\nA REST interface in Apache StreamPipes (versions 0.69.0 to 0.91.0) was not properly restricted to admin-only access. This allowed a non-admin user with valid login credentials to elevate privileges beyond the initially assigned roles.\nThe issue is resolved by upgrading to StreamPipes 0.92.0.\n\n","status":"published","published":"2023-06-23T08:15:09.22Z","modified":"2026-06-17T05:57:02.003Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T14:08:12.414559Z"}],"osv":[{"id":"CVE-2023-31469","title":"Apache StreamPipes: Privilege escalation through non-admin user","description":"\nA REST interface in Apache StreamPipes (versions 0.69.0 to 0.91.0) was not properly restricted to admin-only access. This allowed a non-admin user with valid login credentials to elevate privileges beyond the initially assigned roles.\nThe issue is resolved by upgrading to StreamPipes 0.92.0.\n\n","status":"published","published":"2023-06-23T07:07:42.875Z","modified":"2026-10-28T02:30:33.100546471Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T15:44:31.790231Z"},{"id":"GHSA-pm73-x2h5-cmj3","title":"Apache StreamPipes Improper Privilege Management vulnerability","description":"A REST interface in Apache StreamPipes (versions 0.69.0 to 0.91.0) was not properly restricted to admin-only access. This allowed a non-admin user with valid login credentials to elevate privileges beyond the initially assigned roles.\nThe issue is resolved by upgrading to StreamPipes 0.92.0.\n\n","status":"published","published":"2023-06-23T09:30:17Z","modified":"2024-02-16T07:50:54.518627Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T15:46:53.244788Z"}]}}