PT-2023-19811 · Apache · Apache Iotdb Grafana-Connector

Jialin Qiao · Publicado 2023-04-17 · Atualizado 2024-10-21 · CVE-2023-24831

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache IoTDB Grafana Connector versions 0.13.0 through 0.13.3

Description The issue is related to improper authentication, allowing attackers to log in without authorization. This is a significant security concern as it could lead to unauthorized access to sensitive data or systems. The estimated number of potentially affected devices worldwide is not specified. There is no information provided about real-world incidents where this issue was exploited.

Recommendations For versions 0.13.0 through 0.13.3, update to version 0.13.4 to resolve the issue. As a temporary workaround, consider restricting access to the affected system until the update can be applied.

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2023-24831

GHSA-PVJV-386F-C8WH

PYSEC-2023-7

Produtos afetados

Apache Iotdb Grafana-Connector

Referências · 10

• https://github.com/apache/iotdb · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/apache-iotdb/PYSEC-2023-7.yaml · Nota
• https://t.me/cibsecurity/62267 · Publicação no Telegram
• https://lists.apache.org/thread/3dgvzgstycf8b5hyf4z3n7cqdhcyln3l · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-24831 · Nota de Segurança
• https://t.me/cvenotify/48389 · Publicação no Telegram
• https://osv.dev/vulnerability/PYSEC-2023-7 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-pvjv-386f-c8wh · Aviso do Fabricante
• https://t.me/cvenotify/98959 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-24831 · Aviso do Fabricante