8.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-47411

CVE-2025-47411: Apache StreamPipes: Leverage of User ID for Privilege Escalation

A user with a legitimate non-administrator account can exploit a vulnerability in the user ID creation mechanism in Apache StreamPipes that allows them to swap the username of an existing user with that of an administrator.

This vulnerability allows an attacker to gain administrative control over the application by manipulating JWT tokens, which can lead to data tampering, unauthorized access and other security issues.

This issue affects Apache StreamPipes: through 0.97.0.

Users are recommended to upgrade to version 0.98.0, which fixes the issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-47411

CVE-2025-47411:

8.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.apache.streampipes:streampipes-parent	maven	>= 0.69.0, < 0.98.0	0.98.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability described is an improper privilege management issue in Apache StreamPipes, allowing a non-administrator to gain administrative control by manipulating JWT tokens to swap usernames. The patch for this vulnerability is in version 0.98.0. To identify the vulnerable functions, I analyzed the commits between the last vulnerable version (0.97.0) and the patched version (0.98.0).

By comparing the git tags release/0.97.0 and release/0.98.0, I identified a set of commits. Among them, commit 92db62386239f8b83bb9df1f83ac920f861ce7b5 with the message "refactor: remove UserService class and its associated methods" stood out as highly relevant.

This commit completely removes the UserService.java file. The removed class had a constructor UserService(String email) that fetched user details from the database based on the provided email. This aligns perfectly with the vulnerability description, where an attacker could manipulate their user identifier (email) to impersonate an administrator. The application would then use this UserService object, believing it's interacting with the legitimate administrator.

The removal of the entire class indicates that this was the core of the vulnerability, and the fix involved a significant refactoring of the user management logic to avoid this insecure pattern. Therefore, the constructor of the UserService class is identified as the primary vulnerable function, and the getPassword method is also included as it is part of the same vulnerable class and could be used post-exploitation.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.