Apache HugeGraph-Server: Bypass whitelist in Auth mode

CRITIQUE 9.1CVE-2024-27349 · GHSA-6mgp-p75r-vhjm · Published 22/04/2024 · updated 17/06/2026

En bref

CVE-2024-27349 est une vulnérabilité CRITIQUE (CVSS 9.1) touchant org.apache.hugegraph:hugegraph-api, hugegraph (apache).
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 1.0%, plus élevée que 63.5% des vulnérabilités.
Correctif : mettre à jour vers 1.3.0 ou plus récent.

Package	Affected versions	Patched versions
org.apache.hugegraph:hugegraph-api Maven	`≥ 1.0.0, < 1.3.0`	`1.3.0`
hugegraph apache	`≥ 1.0.0, < 1.3.0`	`1.3.0`

Description

Authentication Bypass by Spoofing vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0.

Users are recommended to upgrade to version 1.3.0, which fixes the issue.

NVD description

Authentication Bypass by Spoofing vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0. Users are recommended to upgrade to version 1.3.0, which fixes the issue.

References

nvd.nist.gov/vuln/detail/CVE-2024-27349 · ADVISORY
apache/incubator-hugegraph commit 713d88d · WEB
apache/incubator-hugegraph · PACKAGE
lists.apache.org/thread/dz9n9lndqfsf64t72o73r7sttrc6ocsd · WEB
openwall.com/lists/oss-security/2024/04/22/4 · WEB

Autres vulnérabilités de org.apache.hugegraph:hugegraph-api

Tout voir →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.apache.hugegraph:hugegraph-api

Maven

≥ 1.0.0, < 1.3.0

1.3.0

hugegraph

apache

≥ 1.0.0, < 1.3.0

1.3.0

Description

Authentication Bypass by Spoofing vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0.

Users are recommended to upgrade to version 1.3.0, which fixes the issue.

NVD description