AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

iotdbGHSA-g6vm-3ch8-c6jq

Apache IoTDB Session Fixation vulnerability

iotdb

CVE-2022-38369 · Published Sep 6, 2022 · updated Nov 26, 2024

Medium8.8
Fix: upgrade to 0.13.1 or later
GitHub advisory

Apache IoTDB version 0.13.0 is vulnerable to session id attack. Users should upgrade to version 0.13.1 which addresses this issue.

Affected versions

PackageAffectedFixed in
apache-iotdb
PyPI
< 0.13.10.13.1
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Severity from
GitHub (reviewed advisory)
Weakness
CWE-384
Also known as
CVE-2022-38369, PYSEC-2022-43069

More iotdb advisories

All iotdb
High 9.8Jan 15, 2024Remote Code Execution vulnerability in Apache IoTDB via UDFCVE-2023-46226fixed in 1.3.0Critical 9.8Apr 17, 2023Apache IoTDB Grafana Connector vulnerable to Improper AuthenticationCVE-2023-24831fixed in 0.13.5Critical 9.8Apr 17, 2023iotdb: improper authorizationCVE-2023-30771no fix yetHigh 8.8Jan 31, 2023iotdb: improper authorizationCVE-2023-24829fixed in 0.13.3High 7.5Jan 30, 2023iotdb: improper authenticationCVE-2023-24830fixed in 0.13.3High 7.5Oct 26, 2022Apache IoTDB subject to ReDOS with Java 8CVE-2022-43766fixed in 0.13.3