AI and data stack advisories

Severe, 6 weeks1498Projects326

1498 severe, 6 weeks · 326 projects

iotdbGHSA-pvjv-386f-c8wh

Apache IoTDB Grafana Connector vulnerable to Improper Authentication

iotdb

CVE-2023-24831 · Published Apr 17, 2023 · updated Sep 12, 2024

Critical9.8
Fix: upgrade to 0.13.5 or later
GitHub advisory

Improper Authentication vulnerability in Apache Software Foundation Apache IoTDB. This issue affects Apache IoTDB Grafana Connector from 0.13.0 through 0.13.3.

Attackers could log in without authorization. This is fixed in 0.13.4.

Affected versions

PackageAffectedFixed in
apache-iotdb
PyPI
>= 0.13.0, < 0.13.50.13.5
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity from
GitHub (reviewed advisory)
Weakness
CWE-287
Also known as
CVE-2023-24831, PYSEC-2023-7

More iotdb advisories

All iotdb
High 9.8Jan 15, 2024Remote Code Execution vulnerability in Apache IoTDB via UDFCVE-2023-46226fixed in 1.3.0Critical 9.8Apr 17, 2023iotdb: improper authorizationCVE-2023-30771no fix yetHigh 8.8Jan 31, 2023iotdb: improper authorizationCVE-2023-24829fixed in 0.13.3High 7.5Jan 30, 2023iotdb: improper authenticationCVE-2023-24830fixed in 0.13.3High 7.5Oct 26, 2022Apache IoTDB subject to ReDOS with Java 8CVE-2022-43766fixed in 0.13.3Medium 8.8Sep 6, 2022Apache IoTDB Session Fixation vulnerabilityCVE-2022-38369fixed in 0.13.1