CVE-2024-24780

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-24780
Remote Code Execution with untrusted URI of UDF vulnerability in Apache IoTDB. The attacker who has privilege to create UDF can register malicious function from untrusted URI. This issue affects Apache IoTDB: from 1.0.0 before 1.3.4. Users are recommended to upgrade to version 1.3.4, which fixes the issue.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://lists.apache.org/thread/xphtm98v3zsk9vlpfh481m1ry2ctxvmj Mailing List Vendor Advisory
http://www.openwall.com/lists/oss-security/2025/05/14/2 Mailing List
Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:iotdb:*:*:*:*:*:*:*:*
History

01 Jul 2025, 19:21

Type Values Removed Values Added
CPE cpe:2.3:a:apache:iotdb:*:*:*:*:*:*:*:*
First Time Apache
Apache iotdb
References () https://lists.apache.org/thread/xphtm98v3zsk9vlpfh481m1ry2ctxvmj - () https://lists.apache.org/thread/xphtm98v3zsk9vlpfh481m1ry2ctxvmj - Mailing List, Vendor Advisory
References () http://www.openwall.com/lists/oss-security/2025/05/14/2 - () http://www.openwall.com/lists/oss-security/2025/05/14/2 - Mailing List

14 May 2025, 14:15

Type Values Removed Values Added
Summary
  • (es) Vulnerabilidad de ejecución remota de código con URI no confiable de UDF en Apache IoTDB. El atacante con privilegios para crear UDF puede registrar una función maliciosa desde una URI no confiable. Este problema afecta a Apache IoTDB desde la versión 1.0.0 hasta la 1.3.4. Se recomienda actualizar a la versión 1.3.4, que soluciona el problema.
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 9.8
CWE CWE-94

14 May 2025, 11:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-05-14 11:15

Updated : 2025-07-01 19:21

NVD link : CVE-2024-24780

Mitre link : CVE-2024-24780

CVE.ORG link : CVE-2024-24780

JSON object : View

Products Affected

apache

  • iotdb
CWE
CWE-94

Improper Control of Generation of Code ('Code Injection')