CVE-2022-46365: 
Java vulnerability analysis and mitigation

Apache StreamPark version 1.0.0 before 2.0.0 contains a logic error vulnerability that allows malicious attackers to modify and reset any user account. The vulnerability exists because when users modify their profile, the username is passed to the server-layer as a parameter without proper verification of whether the username belongs to the currently logged-in user or is a legal user (NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 9.1 (CRITICAL) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H. The vulnerability is classified under CWE-20 (Improper Input Validation) according to the Apache Software Foundation. The attack vector is network-accessible, requires low attack complexity, needs no privileges, and requires no user interaction (NVD).

The vulnerability allows attackers to modify and reset any user account in the system, potentially leading to unauthorized access and account takeover. This could result in high impact on integrity and availability of the system, though confidentiality impact is not directly affected (NVD).

Users of affected versions should upgrade to Apache StreamPark 2.0.0 or later to address this vulnerability (NVD).