CVE-2024-24780
Last modified
CVE-2024-24780 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. Remote Code Execution with untrusted URI of UDF vulnerability in Apache IoTDB. The attacker who has privilege to create UDF can register malicious function from untrusted URI. This issue affects Apache IoTDB: from 1.0.0 before 1.3.4. Users are recommended to upgrade to version 1.3.4, which fixes the issue.. EPSS estimates a 1.30% chance of exploitation in the next 30 days.
Description
Remote Code Execution with untrusted URI of UDF vulnerability in Apache IoTDB. The attacker who has privilege to create UDF can register malicious function from untrusted URI. This issue affects Apache IoTDB: from 1.0.0 before 1.3.4. Users are recommended to upgrade to version 1.3.4, which fixes the issue.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Apache | Iotdb | >= 1.0.0, < 1.3.4 |
References
- https://lists.apache.org/thread/xphtm98v3zsk9vlpfh481m1ry2ctxvmjMailing List, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2024-24780?
How severe is CVE-2024-24780?
How do I fix CVE-2024-24780?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-24775When a virtual server is enabled with VLAN group and SNAT li…7.5
- CVE-2024-24776Mattermost fails to check the required permissions in the PO…4.3
- CVE-2024-24777A cross-site request forgery (CSRF) vulnerability exists in …8.8
- CVE-2024-24778Improper privilege management in a REST interface allowed re…6.5
- CVE-2024-24779Apache Superset with custom roles that include `can write on…6.5
- CVE-2024-2478A vulnerability was found in BradWenqiang HR 2.0. It has bee…9.8
- CVE-2024-24781An unauthenticated remote attacker can use an uncontrolled r…7.5
- CVE-2024-24782An unauthenticated attacker can send a ping request from one…4.3
- CVE-2024-24783Verifying a certificate chain which contains a certificate w…5.9
- CVE-2024-24784The ParseAddressList function incorrectly handles comments (…7.5
- CVE-2024-24785If errors returned from MarshalJSON methods contain user con…5.4
- CVE-2024-24786The protojson.Unmarshal function can enter an infinite loop …7.5
Are you affected by CVE-2024-24780?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST