Vulnerability DatabaseCVE-2024-31411

CVE-2024-31411:
Java vulnerability analysis and mitigation

Overview

Apache StreamPipes through version 0.93.0 contains an Unrestricted Upload of File vulnerability with dangerous type that could potentially lead to remote code execution (RCE). The vulnerability was disclosed in July 2024 and assigned identifier CVE-2024-31411. The vulnerability affects Apache StreamPipes installations up to and including version 0.93.0 (NVD, OSS Security).

Technical details

The vulnerability is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type). The dangerous file type could be an executable that enables remote code execution capabilities. The vulnerability has received a CVSS v3.1 base score of 8.8 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. However, CISA's Alternative Decision Process (ADP) assessed it with a lower CVSS score of 6.0 (MEDIUM) with vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:L (NVD).

Impact

If exploited, this vulnerability could allow an authenticated and authorized user to upload files of dangerous types that may lead to remote code execution on the affected system (OSS Security).

Mitigation and workarounds

Users are recommended to upgrade to Apache StreamPipes version 0.95.0 or later, which contains fixes for this vulnerability (NVD).

Additional resources

Source: This report was generated using AI

View vulnerable instances

Not a Wiz customer? See which CVEs are exploitable in your environment.

Get a CVE Assessment

8.8

Score

Published July 17, 2024

Severity HIGH

CNA Score 6.0

Affected Technologies

Java
Python

Has Public Exploit No

Has CISA KEV Exploit No

CISA KEV Release Date N/A

CISA KEV Due Date N/A

Exploitation Probability Percentile (EPSS) 82.2

Exploitation Probability (EPSS) 1.8

Affected packages and libraries

streampipes
org.apache.streampipes:streampipes-parent

Sources

NVD
GitHub Advisory Database
- Maven Severity HIGHHas FixAdded at: Jul 21, 2024
- pip Severity HIGHHas FixAdded at: Jan 22, 2025
Python Packaging Advisory Database
- pip Has FixAdded at: Jan 19, 2025

Get a CVE risk assessment

Get a prioritized view of CVEs in your cloud—so you can focus on what's exploitable, not just what's listed.

Request assessment

Related Java vulnerabilities:

CVE ID	Severity	Score	Technologies	Component name	CISA KEV exploit	Has fix	Published date
CVE-2025-14306	CRITICAL	10	Java	net.sf.robocode:robocode.core	No	Yes	Dec 09, 2025
CVE-2025-14307	CRITICAL	9.3	Java	net.sf.robocode:robocode.battle	No	Yes	Dec 09, 2025
CVE-2025-66566	HIGH	8.2	Java	at.yawk.lz4:lz4-java	No	Yes	Dec 05, 2025
CVE-2025-66623	HIGH	7.4	Java	io.strimzi:strimzi	No	Yes	Dec 05, 2025
GHSA-93fv-4pm9-xp28	MEDIUM	6.9	Java	net.dv8tion:jda	No	Yes	Dec 09, 2025

Free Vulnerability Assessment

Benchmark your Cloud Security Posture

Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.

Request assessment

Additional Wiz resources

Cloud Vulnerability DB

A community-led vulnerabilities database

Cloud Threat Landscape

A threat intelligence database

PEACH

A tenant isolation framework

Get a personalized demo

Ready to see Wiz in action?

"Best User Experience I have ever seen, provides full visibility to cloud workloads."

David EstlickCISO

"Wiz provides a single pane of glass to see what is going on in our cloud environments."

Adam FletcherChief Security Officer

"We know that if Wiz identifies something as critical, it actually is."

Greg PoniatowskiHead of Threat and Vulnerability Management

Get a demo

CVE-2024-31411: Java vulnerability analysis and mitigation