CVE-2024-27905

CRITICAL 9.1CVE-2024-27905 · Published 27/02/2024 · updated 17/06/2026

In short

CVE-2024-27905 is a CRITICAL (CVSS 9.1) vulnerability affecting aurora (apache).
Chance of exploitation in the next 30 days (EPSS): 1.5%, higher than 73.8% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
aurora apache	`≥ 0.5.0`	No fix yet

Description

** UNSUPPORTED WHEN ASSIGNED ** Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Aurora. An endpoint exposing internals to unauthenticated users can be used as a "padding oracle" allowing an anonymous attacker to construct a valid authentication cookie. Potentially this could be combined with vulnerabilities in other components to achieve remote code execution. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

References

openwall.com/lists/oss-security/2024/02/27/3 · Mailing List
lists.apache.org/thread/564kbv3wqdzkscmdn2bg4vlk48qymryp · Mailing List

More vulnerabilities in aurora

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

aurora

apache

≥ 0.5.0

No fix yet

Description