CVE-2024-27348

CriticalActively exploited (CISA KEV)

Description

RCE-Remote Command Execution vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0 in Java8 & Java11 Users are recommended to upgrade to version 1.3.0 with Java11 & enable the Auth system, which fixes the issue.

SeverityCritical

CVSS9.8

Exploit probability—

Product

Apache HugeGraph-Server

PublishedApr 22, 2024

First seenApr 22, 2024

Added to KEVSep 18, 2024

Weakness typeCWE-284Improper access control

How to fix

CISA required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CISA due date: Oct 9, 2024

Update

apache hugegraph1.3.0 or later
org.apache.hugegraph:hugegraph-api1.3.0 or later
org.apache.hugegraph:hugegraph-core1.3.0 or later

Vendor advisories

lists.apache.org/thread/nx6g6htyhpgtzsocybm242781o8w5kq9

Affected products

Product	Affected versions	Fixed in
apache hugegraph	1.0.0 ≤ v < 1.3.0	1.3.0
org.apache.hugegraph:hugegraph-apiMaven	1.0.0 ≤ v < 1.3.0	1.3.0
org.apache.hugegraph:hugegraph-coreMaven	1.0.0 ≤ v < 1.3.0	1.3.0

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.