PT-2020-5583 · Apache · Apache Iotdb

Published 2020-04-27 · Updated 2022-01-06 · CVE-2020-1952

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache IoTDB versions 0.8.0 through 0.8.2 Apache IoTDB versions 0.9.0 through 0.9.1

Description The issue is related to the exposure of the JMX port 31999 without certification in Apache IoTDB, allowing remote code execution. When IoTDB is started, this port is exposed, enabling clients to execute code remotely.

Recommendations For Apache IoTDB versions 0.8.0 through 0.8.2, consider disabling the JMX port 31999 until a patch is available. For Apache IoTDB versions 0.9.0 through 0.9.1, consider disabling the JMX port 31999 until a patch is available.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

BDU:2021-01204

CVE-2020-1952

GHSA-WC6F-CJCP-CC33

Affected Products

Apache Iotdb

References · 6

• https://osv.dev/vulnerability/CVE-2020-1952 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-1952 · Security Note
• https://bdu.fstec.ru/vul/2021-01204 · Security Note
• https://lists.apache.org/thread.html/r3d2ff899ead64d2952fdc1fbb1f520ca42011ed2b4c7f786e921f6b9%40%3Cdev.iotdb.apache.org%3E · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-wc6f-cjcp-cc33 · Vendor Advisory
• https://t.me/cvenotify/3258 · Telegram Post