GHSA-wc6f-cjcp-cc33

ghsaUSosv

Improper Certificate Validation in Apache IoTDB

view advisory published 2022-01-06Licence: CC-BY-4.0

An issue was found in Apache IoTDB .9.0 to 0.9.1 and 0.8.0 to 0.8.2. When starting IoTDB, the JMX port 31999 is exposed with no certification.Then, clients could execute code remotely.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2020-1952US	critical9.8	2.68% (86th)	—	2020-04-27
An issue was found in Apache IoTDB .9.0 to 0.9.1 and 0.8.0 to 0.8.2. When starting IoTDB, the JMX port 31999 is exposed with no certification.Then, clients could execute code remot…

references

External citations — patches, advisories, analysis.

https://lists.apache.org/thread.html/r3d2ff899ead64d2952fdc1fbb1f520ca42011ed2b4c7f786e921f6b9%40%3Cdev.iotdb.apache.org%3EWEB
https://nvd.nist.gov/vuln/detail/CVE-2020-1952ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan