id: PYSEC-2025-66
modified: 2025-07-08T15:23:46.628375Z
published: 2025-03-03T11:15:11Z
aliases:
- CVE-2024-24778
- GHSA-vm7w-2724-5m23
details: "Improper privilege management in a REST interface allowed registered users
  to access unauthorized resources if the resource ID was know. \n\n\n\n\n\nThis issue
  affects Apache StreamPipes: through 0.95.1.\n\nUsers are recommended to upgrade
  to version 0.97.0 which fixes the issue."
affected:
- package:
    ecosystem: PyPI
    name: streampipes
    purl: pkg:pypi/streampipes
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 0.97.0
  versions:
  - 0.0.2.dev0
  - 0.91.0
  - 0.92.0
  - 0.93.0
  - 0.95.0
references:
- type: ADVISORY
  url: https://lists.apache.org/thread/j14w6wghlwwrgfgc6hoz9f94fwxtlgzh
- type: ARTICLE
  url: https://lists.apache.org/thread/j14w6wghlwwrgfgc6hoz9f94fwxtlgzh
- type: ARTICLE
  url: http://www.openwall.com/lists/oss-security/2025/03/03/1
- type: WEB
  url: http://www.openwall.com/lists/oss-security/2025/03/03/1
- type: ADVISORY
  url: https://github.com/advisories/GHSA-vm7w-2724-5m23