CVE-2024-27348 - OpenCVE

RCE-Remote Command Execution vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0 in Java8 & Java11 Users are recommended to upgrade to version 1.3.0 with Java11 & enable the Auth system, which fixes the issue.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is in the KEV database since yesterday.

Exploitation active

Automatable yes

Technical Impact total

Vendors	Products
Apache	Hugegraph-server

No data.

No data.

References

Link	Providers
http://www.openwall.com/lists/oss-security/2024/04/22/3
https://hugegraph.apache.org/docs/config/config-authentication/#configure-user-authentication
https://lists.apache.org/thread/nx6g6htyhpgtzsocybm242781o8w5kq9

History

Wed, 18 Sep 2024 18:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Apache Apache hugegraph-server
CPEs		cpe:2.3:a:apache:hugegraph-server::::::::
Vendors & Products		Apache Apache hugegraph-server
References	https://www.vicarius.io/vsociety/posts/remote-code-execution-vulnerability-in-apache-hugegraph-server-cve-2024-27348
Metrics		kev `{'dateAdded': '2024-09-18'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'active', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Mon, 19 Aug 2024 08:30:00 +0000

Type	Values Removed	Values Added
References		https://www.vicarius.io/vsociety/posts/remote-code-execution-vulnerability-in-apache-hugegraph-server-cve-2024-27348

MITRE

Status: PUBLISHED

Assigner: apache

Published: 2024-04-22T14:08:06.294Z

Updated: 2024-09-18T18:06:59.453Z

Reserved: 2024-02-24T10:43:56.141Z

Link: CVE-2024-27348

Vulnrichment

Updated: 2024-08-19T07:47:46.503Z

NVD

Status : Awaiting Analysis

Published: 2024-04-22T14:15:07.420

Modified: 2024-09-19T01:00:03.120

Link: CVE-2024-27348

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-27348", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2024-02-24T10:43:56.141Z", "datePublished": "2024-04-22T14:08:06.294Z", "dateUpdated": "2024-09-18T18:06:59.453Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Apache HugeGraph-Server", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "1.3.0", "status": "affected", "version": "1.0.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "6right of moresec"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "RCE-Remote Command Execution vulnerability in Apache HugeGraph-Server.<p>This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0 in Java8 & Java11</p><p>Users are recommended to upgrade to version 1.3.0 with Java11 & enable the Auth system, which fixes the issue.</p>"}], "value": "RCE-Remote Command Execution vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0 in Java8 & Java11\n\nUsers are recommended to upgrade to version 1.3.0 with Java11 & enable the Auth system, which fixes the issue.\n\n"}], "metrics": [{"other": {"content": {"text": "important"}, "type": "Textual description of severity"}}], "problemTypes": [{"descriptions": [{"description": "RCE-Remote Command Execution", "lang": "en"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2024-04-22T14:08:06.294Z"}, "references": [{"tags": ["related"], "url": "https://hugegraph.apache.org/docs/config/config-authentication/#configure-user-authentication"}, {"tags": ["vendor-advisory"], "url": "https://lists.apache.org/thread/nx6g6htyhpgtzsocybm242781o8w5kq9"}, {"url": "http://www.openwall.com/lists/oss-security/2024/04/22/3"}], "source": {"discovery": "EXTERNAL"}, "title": "Apache HugeGraph-Server: Command execution in gremlin", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-284", "lang": "en", "description": "CWE-284 Improper Access Control"}]}], "affected": [{"vendor": "apache", "product": "hugegraph-server", "cpes": ["cpe:2.3:a:apache:hugegraph-server:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "versions": [{"version": "1.0.0", "status": "affected", "lessThan": "1.3.0", "versionType": "semver"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-09-18T18:06:53.051543Z", "id": "CVE-2024-27348", "options": [{"Exploitation": "active"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}, {"other": {"type": "kev", "content": {"dateAdded": "2024-09-18", "reference": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-18T18:06:59.453Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-19T07:47:46.503Z"}, "title": "CVE Program Container", "references": [{"tags": ["related", "x_transferred"], "url": "https://hugegraph.apache.org/docs/config/config-authentication/#configure-user-authentication"}, {"tags": ["vendor-advisory", "x_transferred"], "url": "https://lists.apache.org/thread/nx6g6htyhpgtzsocybm242781o8w5kq9"}, {"url": "http://www.openwall.com/lists/oss-security/2024/04/22/3", "tags": ["x_transferred"]}, {"url": "https://www.vicarius.io/vsociety/posts/remote-code-execution-vulnerability-in-apache-hugegraph-server-cve-2024-27348"}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://hugegraph.apache.org/docs/config/config-authentication/#configure-user-authentication", "tags": ["related", "x_transferred"]}, {"url": "https://lists.apache.org/thread/nx6g6htyhpgtzsocybm242781o8w5kq9", "tags": ["vendor-advisory", "x_transferred"]}, {"url": "http://www.openwall.com/lists/oss-security/2024/04/22/3", "tags": ["x_transferred"]}, {"url": "https://www.vicarius.io/vsociety/posts/remote-code-execution-vulnerability-in-apache-hugegraph-server-cve-2024-27348"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-19T07:47:46.503Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-27348", "role": "CISA Coordinator", "options": [{"Exploitation": "active"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-09-18T18:06:53.051543Z"}}}, {"other": {"type": "kev", "content": {"dateAdded": "2024-09-18", "reference": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"}}}], "affected": [{"cpes": ["cpe:2.3:a:apache:hugegraph-server:*:*:*:*:*:*:*:*"], "vendor": "apache", "product": "hugegraph-server", "versions": [{"status": "affected", "version": "1.0.0", "lessThan": "1.3.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "CWE-284 Improper Access Control"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-04-23T16:09:20.612Z"}}], "cna": {"title": "Apache HugeGraph-Server: Command execution in gremlin", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "reporter", "value": "6right of moresec"}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "important"}}}], "affected": [{"vendor": "Apache Software Foundation", "product": "Apache HugeGraph-Server", "versions": [{"status": "affected", "version": "1.0.0", "lessThan": "1.3.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://hugegraph.apache.org/docs/config/config-authentication/#configure-user-authentication", "tags": ["related"]}, {"url": "https://lists.apache.org/thread/nx6g6htyhpgtzsocybm242781o8w5kq9", "tags": ["vendor-advisory"]}, {"url": "http://www.openwall.com/lists/oss-security/2024/04/22/3"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "RCE-Remote Command Execution vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0 in Java8 & Java11\n\nUsers are recommended to upgrade to version 1.3.0 with Java11 & enable the Auth system, which fixes the issue.\n\n", "supportingMedia": [{"type": "text/html", "value": "RCE-Remote Command Execution vulnerability in Apache HugeGraph-Server.<p>This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0 in Java8 & Java11</p><p>Users are recommended to upgrade to version 1.3.0 with Java11 & enable the Auth system, which fixes the issue.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "RCE-Remote Command Execution"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2024-04-22T14:08:06.294Z"}}}, "cveMetadata": {"cveId": "CVE-2024-27348", "state": "PUBLISHED", "dateUpdated": "2024-09-18T18:06:59.453Z", "dateReserved": "2024-02-24T10:43:56.141Z", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "datePublished": "2024-04-22T14:08:06.294Z", "assignerShortName": "apache"}, "dataVersion": "5.1"}