Apache IoTDB grafana-connector contains an interface without authorization

高危 7.5CVE-2022-38370 · GHSA-c86f-9grv-pmqf · Published 05/09/2022 · updated 17/06/2026

要点

CVE-2022-38370 是影响 org.apache.iotdb:iotdb-grafana-connector, iotdb (apache) 的高危 (CVSS 7.5)漏洞。
未来 30 天内被利用的概率（EPSS）：1.4%，高于 72.1% 的漏洞。
修复：升级到 0.13.1 或更高版本。

Package	Affected versions	Patched versions
org.apache.iotdb:iotdb-grafana-connector Maven	`< 0.13.1`	`0.13.1`
iotdb apache	`= 0.13.0`	No fix yet

Description

Apache IoTDB grafana-connector version 0.13.0 contains an interface without authorization, which may expose the internal structure of a database. Users should upgrade to version 0.13.1, which addresses this issue.

NVD description

Apache IoTDB grafana-connector version 0.13.0 contains an interface without authorization, which may expose the internal structure of database. Users should upgrade to version 0.13.1 which addresses this issue.

References

nvd.nist.gov/vuln/detail/CVE-2022-38370 · ADVISORY
apache/iotdb · PACKAGE
pypa/advisory-database · WEB
lists.apache.org/thread/kcpqgstvgf8sxy9ktxm1836nlwc8xy3j · WEB
openwall.com/lists/oss-security/2022/09/05/2 · WEB

org.apache.iotdb:iotdb-grafana-connector 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free