PT-2024-10202 · Apache · Apache Hugegraph-Server

L0Ne1Y · Published 2024-08-13 · Updated 2026-02-16 · CVE-2024-43441

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache HugeGraph-Server versions 1.0.0 through 1.5.0

Description The issue is related to an authentication bypass vulnerability in Apache HugeGraph-Server, which can be exploited by remote attackers to execute arbitrary code. This vulnerability is caused by the exploitation of assumed-immutable data.

Recommendations To resolve the issue, users are recommended to upgrade to version 1.5.0, which fixes the issue. As a temporary workaround, consider restricting access to sensitive graph data until the upgrade is applied.

Fix

Weakness Enumeration

CWE-302

Related Identifiers

BDU:2025-00531

CVE-2024-43441

GHSA-F697-GM3H-XRF9

Affected Products

Apache Hugegraph-Server

References · 36

• https://nvd.nist.gov/vuln/detail/CVE-2024-43441 · Security Note
• https://bdu.fstec.ru/vul/2025-00531 · Security Note
• https://osv.dev/vulnerability/CVE-2024-43441 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-f697-gm3h-xrf9 · Vendor Advisory
• https://lists.apache.org/thread/h2607yv32wgcrywov960jpxhvsmmlf12 · Vendor Advisory
• https://github.com/apache/incubator-hugegraph · Note
• https://github.com/apache/incubator-hugegraph/commit/03b40a52446218c83e98cb43020e0593a744a246 · Note
• https://openwall.com/lists/oss-security/2024/12/24/2 · Note
• https://twitter.com/Patrowl_io/status/1873766451322265679 · Twitter Post
• https://twitter.com/fletch_ai/status/1910890712373318068 · Twitter Post
• https://twitter.com/Eth1calHackrZ/status/1873085257773203802 · Twitter Post
• https://twitter.com/Dinosn/status/1872203362638446936 · Twitter Post
• https://t.me/cvenotify/127295 · Telegram Post
• https://twitter.com/Komodosec/status/1873202160571433354 · Twitter Post
• https://twitter.com/TMJIntel/status/1874127877551104284 · Twitter Post