iotdbGHSA-f4rq-f4j9-f6rm
Apache IoTDB Vulnerable to Remote Code Execution
Critical9.8CVE-2024-24780 · Published May 14, 2025 · updated Jul 2, 2025
Remote Code Execution with untrusted URI of UDF vulnerability in Apache IoTDB. The attacker who has privilege to create UDF can register malicious function from untrusted URI. This issue affects Apache IoTDB: from 1.0.0 before 1.3.4. Users are recommended to upgrade to version 1.3.4, which fixes the issue.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| apache-iotdb PyPI | >= 1.0.0, < 1.3.4 | 1.3.4 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-94
- Also known as
- CVE-2024-24780, PYSEC-2025-59
More iotdb advisories
All iotdb| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Jul 6 | iotdb: path traversal Critical9.8Jul 6 | Critical9.8 | 2.0.8 |
| Jul 6 | Authentication Bypass by Spoofing vulnerability in Apache IoTDBCritical9.1Jul 6 | Critical9.1 | 2.0.8 |
| Jul 6 | Uncontrolled Resource Consumption vulnerability in Apache IoTDBHigh7.5Jul 6 | High7.5 | 2.0.8 |
| Sep 242025 | Apache IoTDB: Deserialization of untrusted DataCritical5.3Sep 24, 2025 | Critical5.3 | 2.0.5 |
| May 142025 | Apache IoTDB Discloses Sensitive Information via Log FilesMediumMay 14, 2025 | Medium | 1.3.4+1 more |
| Jan 152024 | Remote Code Execution vulnerability in Apache IoTDB via UDFHigh9.8Jan 15, 2024 | High9.8 | 1.3.0 |