iotdbGHSA-pvjv-386f-c8wh
Apache IoTDB Grafana Connector vulnerable to Improper Authentication
Critical9.8CVE-2023-24831 · Published Apr 17, 2023 · updated Sep 12, 2024
Improper Authentication vulnerability in Apache Software Foundation Apache IoTDB. This issue affects Apache IoTDB Grafana Connector from 0.13.0 through 0.13.3. Attackers could log in without authorization. This is fixed in 0.13.4.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| apache-iotdb PyPI | >= 0.13.0, < 0.13.5 | 0.13.5 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-287
- Also known as
- CVE-2023-24831, PYSEC-2023-7
More iotdb advisories
All iotdb| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Jan 152024 | Remote Code Execution vulnerability in Apache IoTDB via UDF High9.8Jan 15, 2024 | High9.8 | 1.3.0 |
| Apr 172023 | iotdb: improper authorizationUnratedApr 17, 2023 | Unrated | No fix yet |
| Jan 312023 | iotdb: improper authorizationUnratedJan 31, 2023 | Unrated | 0.13.3 |
| Jan 302023 | iotdb: improper authenticationUnratedJan 30, 2023 | Unrated | 0.13.3 |
| Oct 262022 | Apache IoTDB subject to ReDOS with Java 8High7.5Oct 26, 2022 | High7.5 | 0.13.3 |
| Sep 62022 | Apache IoTDB Session Fixation vulnerabilityMedium8.8Sep 6, 2022 | Medium8.8 | 0.13.1 |