PT-2024-2664 · Apache · Apache Aurora

Duc Nguyen + 1 · Published 2024-02-27 · Updated 2025-07-10 · CVE-2024-27905

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Critical

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache Aurora (affected versions not specified)

Description The issue is related to the exposure of sensitive information. An endpoint that exposes internals to unauthenticated users can be used as a "padding oracle", allowing an anonymous attacker to construct a valid authentication cookie. This could potentially be combined with vulnerabilities in other components to achieve remote code execution. The project is retired, and no fix is planned.

Recommendations As the project is retired and no version with a fix will be released, users are recommended to find an alternative. Restrict access to the instance to trusted users to minimize the risk of exploitation.

Fix

RCE

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2024-02738

CVE-2024-27905

Affected Products

Apache Aurora

References · 17

• https://lists.apache.org/thread/564kbv3wqdzkscmdn2bg4vlk48qymryp · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-02738 · Security Note
• https://osv.dev/vulnerability/CVE-2024-27905 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-27905 · Security Note
• https://cybersecurity-help.cz/vdb/SB2024030146 · Note
• https://t.me/cvenotify/87439 · Telegram Post
• https://openwall.com/lists/oss-security/2024/02/27/3 · Note
• https://t.me/cvenotify/80159 · Telegram Post
• http://openwall.com/lists/oss-security/2024/02/27/3 · Note
• https://t.me/cvenotify/79727 · Telegram Post
• https://t.me/cvenotify/128319 · Telegram Post
• https://vuldb.com/?id.254895 · Note
• https://twitter.com/VulmonFeeds/status/1762493244103889208 · Twitter Post
• https://twitter.com/CVEnew/status/1762487483550367834 · Twitter Post
• https://twitter.com/oss_security/status/1762514325237850489 · Twitter Post