CVE-2024-27348

Published Apr 22, 2024

Last updated 6 months ago

Apache HugeGraph

Overview

AI description

Automated description summarized from trusted sources.

CVE-2024-27348 is a Remote Command Execution (RCE) vulnerability affecting Apache HugeGraph-Server versions 1.0.0 to before 1.3.0, in both Java 8 and Java 11 environments. The vulnerability lies in how Apache HugeGraph-Server handles user inputs in Gremlin queries. This flaw allows attackers to send specially crafted Gremlin queries that exploit the GremlinGroovyScriptEngine class to execute arbitrary OS commands. Successful exploitation could lead to unauthorized access, data manipulation, and complete system compromise.

Description: RCE-Remote Command Execution vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0 in Java8 & Java11 Users are recommended to upgrade to version 1.3.0 with Java11 & enable the Auth system, which fixes the issue.
Source: security@apache.org
NVD status: Analyzed
Products: hugegraph

Risk scores

CVSS 3.1

Type: Primary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Known exploits

Data from CISA

Vulnerability name: Apache HugeGraph-Server Improper Access Control Vulnerability
Exploit added on: Sep 18, 2024
Exploit action due: Oct 9, 2024
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Weaknesses

nvd@nist.gov: NVD-CWE-noinfo
134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-284

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:apache:hugegraph:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "5DDD7AA3-3439-48D7-B24B-1D9D31B284BD",
            "versionEndExcluding": "1.3.0",
            "versionStartIncluding": "1.0.0"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.