PT-2023-19811 · Apache · Apache Iotdb Grafana-Connector

Jialin Qiao · Published 2023-04-17 · Updated 2024-10-21 · CVE-2023-24831

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache IoTDB Grafana Connector versions 0.13.0 through 0.13.3

Description The issue is related to improper authentication, allowing attackers to log in without authorization. This is a significant security concern as it could lead to unauthorized access to sensitive data or systems. The estimated number of potentially affected devices worldwide is not specified. There is no information provided about real-world incidents where this issue was exploited.

Recommendations For versions 0.13.0 through 0.13.3, update to version 0.13.4 to resolve the issue. As a temporary workaround, consider restricting access to the affected system until the update can be applied.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2023-24831

GHSA-PVJV-386F-C8WH

PYSEC-2023-7

Affected Products

Apache Iotdb Grafana-Connector

References · 10

• https://lists.apache.org/thread/3dgvzgstycf8b5hyf4z3n7cqdhcyln3l · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-24831 · Security Note
• https://osv.dev/vulnerability/PYSEC-2023-7 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-pvjv-386f-c8wh · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-24831 · Vendor Advisory
• https://github.com/apache/iotdb · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/apache-iotdb/PYSEC-2023-7.yaml · Note
• https://t.me/cibsecurity/62267 · Telegram Post
• https://t.me/cvenotify/48389 · Telegram Post
• https://t.me/cvenotify/98959 · Telegram Post