Apache IoTDB grafana-connector Login Bypass Vulnerability
CVE-2023-24831

9.8CRITICAL

Key Information:

Vendor

Apache
Status
Apache Iotdb
Vendor
CVE Published:
17 April 2023

What is CVE-2023-24831?

An improper authentication vulnerability exists in the Apache IoTDB Grafana Connector that allows unauthorized access to the system. This flaw impacts versions 0.13.0 through 0.13.3, enabling attackers to log in without proper credentials. The issue has been addressed in version 0.13.4, which mitigates the risk by enforcing correct authentication measures.

Affected Version(s)

Apache IoTDB 0.13.0 <= 0.13.3

References

https://lists.apache.org/thread/3dgvzgstycf8b5hyf4z3n7cqd...
vendor-advisory

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.