GitHub Advisoryadvisory · Maven, PyPI

GHSA-f4rq-f4j9-f6rm Apache IoTDB Vulnerable to Remote Code Execution

CRITICAL Published 2025-05-14 Modified 2025-07-02 Official page ↗
Aliases
CVE-2024-24780
Ecosystem
Maven, PyPI
Packages
org.apache.iotdb:iotdb-core, apache-iotdb
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-94
Reviewed
2025-05-15

Affected packages

• Maven org.apache.iotdb:iotdb-core: >= 1.0.0, < 1.3.4 → fixed in 1.3.4 • PyPI apache-iotdb: >= 1.0.0, < 1.3.4 → fixed in 1.3.4

Description

Remote Code Execution with untrusted URI of UDF vulnerability in Apache IoTDB. The attacker who has privilege to create UDF can register malicious function from untrusted URI. This issue affects Apache IoTDB: from 1.0.0 before 1.3.4. Users are recommended to upgrade to version 1.3.4, which fixes the issue.

Related

Alias · CVE (1)

  • CVE-2024-24780 Remote Code Execution with untrusted URI of UDF vulnerability in Apache IoTDB. vulnerability

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References