CVE-2024-27348 Apache HugeGraph-Server: Command execution in gremlin

2024-04-2214:08:06

apache

github.com

apache hugegraph-server

command execution

remote command execution

vulnerability

java8

java11

upgrade

authentication system

AI Score

6.7

Confidence

Low

EPSS

0.009

Percentile

82.9%

SSVC

Exploitation

active

Automatable

yes

Technical Impact

total

JSON

RCE-Remote Command Execution vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0 in Java8 & Java11

Users are recommended to upgrade to version 1.3.0 with Java11 & enable the Auth system, which fixes the issue.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:apache:hugegraph-server:*:*:*:*:*:*:*:*"
    ],
    "vendor": "apache",
    "product": "hugegraph-server",
    "versions": [
      {
        "status": "affected",
        "version": "1.0.0",
        "lessThan": "1.3.0",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]