GitHub Advisoryadvisory · Maven

GHSA-wc6f-cjcp-cc33 Improper Certificate Validation in Apache IoTDB

HIGH Published 2022-01-06 Modified 2021-05-25 Official page ↗
Aliases
CVE-2020-1952
Ecosystem
Maven
Packages
org.apache.iotdb:iotdb-parent
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-295
Reviewed
2021-05-25

Affected packages

• Maven org.apache.iotdb:iotdb-parent: < 0.9.2 → fixed in 0.9.2

Description

An issue was found in Apache IoTDB .9.0 to 0.9.1 and 0.8.0 to 0.8.2. When starting IoTDB, the JMX port 31999 is exposed with no certification.Then, clients could execute code remotely.

Related

Alias · CVE (1)

  • CVE-2020-1952 An issue was found in Apache IoTDB .9.0 to 0.9.1 and 0.8.0 to 0.8.2. vulnerability

Weakness · CWE (1)

  • CWE-295 Improper Certificate Validation weakness

References