CVE-2024-27347 - OpenCVE

Server-Side Request Forgery (SSRF) vulnerability in Apache HugeGraph-Hubble.This issue affects Apache HugeGraph-Hubble: from 1.0.0 before 1.3.0. Users are recommended to upgrade to version 1.3.0, which fixes the issue.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

No data.

No data.

No data.

References

Link	Providers
http://www.openwall.com/lists/oss-security/2024/04/22/2
https://lists.apache.org/thread/z0v71148slfkw60hsp35pl7ddjyvg01l

History

No history.

MITRE

Status: PUBLISHED

Assigner: apache

Published: 2024-04-22T14:07:37.300Z

Updated: 2024-08-02T00:34:52.209Z

Reserved: 2024-02-24T10:42:06.100Z

Link: CVE-2024-27347

Vulnrichment

Updated: 2024-08-02T00:34:52.209Z

NVD

Status : Awaiting Analysis

Published: 2024-04-22T14:15:07.310

Modified: 2024-07-03T01:50:32.683

Link: CVE-2024-27347

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-27347", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2024-02-24T10:42:06.100Z", "datePublished": "2024-04-22T14:07:37.300Z", "dateUpdated": "2024-08-02T00:34:52.209Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected", "packageName": "org.apache.hugegraph:hubble-be", "product": "Apache HugeGraph-Hubble", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "1.3.0", "status": "affected", "version": "1.0.0", "versionType": "maven"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "6right of moresec"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Server-Side Request Forgery (SSRF) vulnerability in Apache HugeGraph-Hubble.<p>This issue affects Apache HugeGraph-Hubble: from 1.0.0 before 1.3.0.</p><p>Users are recommended to upgrade to version 1.3.0, which fixes the issue.</p>"}], "value": "Server-Side Request Forgery (SSRF) vulnerability in Apache HugeGraph-Hubble.This issue affects Apache HugeGraph-Hubble: from 1.0.0 before 1.3.0.\n\nUsers are recommended to upgrade to version 1.3.0, which fixes the issue.\n\n"}], "metrics": [{"other": {"content": {"text": "moderate"}, "type": "Textual description of severity"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-918", "description": "CWE-918 Server-Side Request Forgery (SSRF)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2024-04-22T14:07:37.300Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://lists.apache.org/thread/z0v71148slfkw60hsp35pl7ddjyvg01l"}, {"url": "http://www.openwall.com/lists/oss-security/2024/04/22/2"}], "source": {"discovery": "EXTERNAL"}, "title": "Apache HugeGraph-Hubble: SSRF in Hubble connection page", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-27347", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-04-22T21:11:52.173654Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:apache:hugegraph-hubble:1.0.0:*:*:*:*:*:*:*"], "vendor": "apache", "product": "hugegraph-hubble", "versions": [{"status": "affected", "version": "1.0.0"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:46:33.643Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:34:52.209Z"}, "title": "CVE Program Container", "references": [{"tags": ["vendor-advisory", "x_transferred"], "url": "https://lists.apache.org/thread/z0v71148slfkw60hsp35pl7ddjyvg01l"}, {"url": "http://www.openwall.com/lists/oss-security/2024/04/22/2", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.apache.org/thread/z0v71148slfkw60hsp35pl7ddjyvg01l", "tags": ["vendor-advisory", "x_transferred"]}, {"url": "http://www.openwall.com/lists/oss-security/2024/04/22/2", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:34:52.209Z"}}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-27347", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-04-22T21:11:52.173654Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:apache:hugegraph-hubble:1.0.0:*:*:*:*:*:*:*"], "vendor": "apache", "product": "hugegraph-hubble", "versions": [{"status": "affected", "version": "1.0.0"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-04-22T17:18:56.424Z"}, "title": "CISA ADP Vulnrichment"}], "cna": {"title": "Apache HugeGraph-Hubble: SSRF in Hubble connection page", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "reporter", "value": "6right of moresec"}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "moderate"}}}], "affected": [{"vendor": "Apache Software Foundation", "product": "Apache HugeGraph-Hubble", "versions": [{"status": "affected", "version": "1.0.0", "lessThan": "1.3.0", "versionType": "maven"}], "packageName": "org.apache.hugegraph:hubble-be", "collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected"}], "references": [{"url": "https://lists.apache.org/thread/z0v71148slfkw60hsp35pl7ddjyvg01l", "tags": ["vendor-advisory"]}, {"url": "http://www.openwall.com/lists/oss-security/2024/04/22/2"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "Server-Side Request Forgery (SSRF) vulnerability in Apache HugeGraph-Hubble.This issue affects Apache HugeGraph-Hubble: from 1.0.0 before 1.3.0.\n\nUsers are recommended to upgrade to version 1.3.0, which fixes the issue.\n\n", "supportingMedia": [{"type": "text/html", "value": "Server-Side Request Forgery (SSRF) vulnerability in Apache HugeGraph-Hubble.<p>This issue affects Apache HugeGraph-Hubble: from 1.0.0 before 1.3.0.</p><p>Users are recommended to upgrade to version 1.3.0, which fixes the issue.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918 Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2024-04-22T14:07:37.300Z"}}}, "cveMetadata": {"cveId": "CVE-2024-27347", "state": "PUBLISHED", "dateUpdated": "2024-08-02T00:34:52.209Z", "dateReserved": "2024-02-24T10:42:06.100Z", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "datePublished": "2024-04-22T14:07:37.300Z", "assignerShortName": "apache"}, "dataVersion": "5.1"}