Apache IoTDB Grafana Connector vulnerable to Improper Authentication

严重 9.8CVE-2023-24831 · GHSA-pvjv-386f-c8wh · PYSEC-2023-7 · Published 17/04/2023 · updated 17/06/2026

要点

CVE-2023-24831 是影响 org.apache.iotdb:iotdb-grafana-connector, apache-iotdb, iotdb (apache) 的严重 (CVSS 9.8)漏洞。
未来 30 天内被利用的概率（EPSS）：1.2%，高于 68.7% 的漏洞。
修复：升级到 0.13.4, 0.13.5 或更高版本。

Package	Affected versions	Patched versions
org.apache.iotdb:iotdb-grafana-connector Maven	`≥ 0.13.0, < 0.13.4`	`0.13.4`
apache-iotdb PyPI	`≥ 0.13.0, < 0.13.5`	`0.13.5`
iotdb apache	`≥ 0.13.0, ≤ 0.13.3`	No fix yet

Description

Improper Authentication vulnerability in Apache Software Foundation Apache IoTDB. This issue affects Apache IoTDB Grafana Connector from 0.13.0 through 0.13.3.

Attackers could log in without authorization. This is fixed in 0.13.4.

NVD description

Improper Authentication vulnerability in Apache Software Foundation Apache IoTDB.This issue affects Apache IoTDB Grafana Connector: from 0.13.0 through 0.13.3. Attackers could login without authorization. This is fixed in 0.13.4.

References

nvd.nist.gov/vuln/detail/CVE-2023-24831 · ADVISORY
apache/iotdb · PACKAGE
pypa/advisory-database · WEB
lists.apache.org/thread/3dgvzgstycf8b5hyf4z3n7cqdhcyln3l · WEB
GitHub Advisory GHSA-pvjv-386f-c8wh · ADVISORY

org.apache.iotdb:iotdb-grafana-connector 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.apache.iotdb:iotdb-grafana-connector

Maven

≥ 0.13.0, < 0.13.4

0.13.4

apache-iotdb

PyPI

≥ 0.13.0, < 0.13.5

0.13.5

iotdb

apache

≥ 0.13.0, ≤ 0.13.3

No fix yet

Description

Improper Authentication vulnerability in Apache Software Foundation Apache IoTDB. This issue affects Apache IoTDB Grafana Connector from 0.13.0 through 0.13.3.

Attackers could log in without authorization. This is fixed in 0.13.4.

NVD description