Apache HugeGraph-Server: Bypass whitelist in Auth mode

KRITISCH 9.1CVE-2024-27349 · GHSA-6mgp-p75r-vhjm · Published 22/04/2024 · updated 17/06/2026

Kurz gesagt

CVE-2024-27349 ist eine Schwachstelle (KRITISCH (CVSS 9.1)) in org.apache.hugegraph:hugegraph-api, hugegraph (apache).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 1.0%, höher als bei 63.5% aller Schwachstellen.
Abhilfe: auf 1.3.0 oder neuer aktualisieren.

Package	Affected versions	Patched versions
org.apache.hugegraph:hugegraph-api Maven	`≥ 1.0.0, < 1.3.0`	`1.3.0`
hugegraph apache	`≥ 1.0.0, < 1.3.0`	`1.3.0`

Description

Authentication Bypass by Spoofing vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0.

Users are recommended to upgrade to version 1.3.0, which fixes the issue.

NVD description

Authentication Bypass by Spoofing vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0. Users are recommended to upgrade to version 1.3.0, which fixes the issue.

References

nvd.nist.gov/vuln/detail/CVE-2024-27349 · ADVISORY
apache/incubator-hugegraph commit 713d88d · WEB
apache/incubator-hugegraph · PACKAGE
lists.apache.org/thread/dz9n9lndqfsf64t72o73r7sttrc6ocsd · WEB
openwall.com/lists/oss-security/2024/04/22/4 · WEB

Weitere Schwachstellen in org.apache.hugegraph:hugegraph-api

Alle anzeigen →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.apache.hugegraph:hugegraph-api

Maven

≥ 1.0.0, < 1.3.0

1.3.0

hugegraph

apache

≥ 1.0.0, < 1.3.0

1.3.0

Description

Authentication Bypass by Spoofing vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0.

Users are recommended to upgrade to version 1.3.0, which fixes the issue.

NVD description