7.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-30001

CVE-2025-30001: Apache StreamPark contains an Incorrect Execution-Assigned Permissions vulnerability

Incorrect Execution-Assigned Permissions vulnerability in Apache StreamPark. This issue affects Apache StreamPark: from 2.1.4 before 2.1.6. Users are recommended to upgrade to version 2.1.6, which fixes the issue. Version 2.1.6 has yet to be published in the Maven registry.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-30001

CVE-2025-30001:

7.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.apache.streampark:streampark	maven	<= 2.1.5

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, described as 'Incorrect Execution-Assigned Permissions', stems from unauthorized access to Spring Boot Actuator endpoints in Apache StreamPark. The investigation into the commits between the last vulnerable version (2.1.5) and the patched version (2.1.6) revealed a key commit 9168dabd9879999c570a64904c76e308c6af81d6 titled '[Improve] Unauthorized access to Spring Boot Actuator'.

This commit introduces two critical changes:

Dependency Removal: The spring-boot-starter-actuator dependency is removed from streampark-console/streampark-console-service/pom.xml. This is the library that provides the actuator endpoints.
Explicit Disabling: The property management.endpoints.enabled-by-default is set to false within the getSpringConfig method in org.apache.streampark.console.base.config.SpringProperties. This explicitly disables the actuator endpoints that might be brought in by other transitive dependencies.

Prior to the patch, the getSpringConfig function did not configure any restrictions on the actuator endpoints, and because the dependency was present, they were exposed by default. This allowed any unauthenticated user to access endpoints that could reveal sensitive information about the application's state and configuration. The getSpringConfig method is the most direct runtime indicator related to this vulnerability, as it is responsible for the application's configuration that led to the exposure of the actuator endpoints.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.