PT-2024-10202 · Apache · Apache Hugegraph-Server

L0Ne1Y · CVE-2024-43441 · Published 2024-08-13 · Updated 2026-02-16

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache HugeGraph-Server versions 1.0.0 through 1.5.0

Description The issue is related to an authentication bypass vulnerability in Apache HugeGraph-Server, which can be exploited by remote attackers to execute arbitrary code. This vulnerability is caused by the exploitation of assumed-immutable data.

Recommendations To resolve the issue, users are recommended to upgrade to version 1.5.0, which fixes the issue. As a temporary workaround, consider restricting access to sensitive graph data until the upgrade is applied.

Exploit

Fix

Weakness Enumeration

CWE-302

Related Identifiers

BDU:2025-00531

CVE-2024-43441

GHSA-F697-GM3H-XRF9

Affected Products

Apache Hugegraph-Server

References · 37

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/43xxx/CVE-2024-43441.json · Exploit
• https://osv.dev/vulnerability/CVE-2024-43441 · Vendor Advisory
• https://lists.apache.org/thread/h2607yv32wgcrywov960jpxhvsmmlf12 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-f697-gm3h-xrf9 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-43441 · Security Note
• https://bdu.fstec.ru/vul/2025-00531 · Security Note
• https://github.com/apache/incubator-hugegraph · Note
• https://github.com/apache/incubator-hugegraph/commit/03b40a52446218c83e98cb43020e0593a744a246 · Note
• https://twitter.com/Komodosec/status/1873202160571433354 · Twitter Post
• https://twitter.com/Patrowl_io/status/1873766451322265679 · Twitter Post
• https://twitter.com/oss_security/status/1871591277600596108 · Twitter Post
• https://t.me/cvenotify/105420 · Telegram Post
• https://t.me/cvenotify/105888 · Telegram Post
• https://t.me/true_secator/6590 · Telegram Post
• https://openwall.com/lists/oss-security/2024/12/24/2 · Note