GHSA-pvjv-386f-c8wh

Source

https://github.com/advisories/GHSA-pvjv-386f-c8wh

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/04/GHSA-pvjv-386f-c8wh/GHSA-pvjv-386f-c8wh.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-pvjv-386f-c8wh

Aliases

CVE-2023-24831
PYSEC-2023-7

Published

2023-04-17T09:30:24Z

Modified

2024-09-12T19:50:13.461806Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

Apache IoTDB Grafana Connector vulnerable to Improper Authentication

Details

Improper Authentication vulnerability in Apache Software Foundation Apache IoTDB. This issue affects Apache IoTDB Grafana Connector from 0.13.0 through 0.13.3.

Attackers could log in without authorization. This is fixed in 0.13.4.

Database specific

{
    "nvd_published_at": "2023-04-17T07:15:00Z",
    "cwe_ids": [
        "CWE-287"
    ],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "github_reviewed_at": "2023-04-21T20:28:03Z"
}

References

Affected packages

Maven / org.apache.iotdb:iotdb-grafana-connector

Package

Name: org.apache.iotdb:iotdb-grafana-connector; View open source insights on deps.dev
Purl: pkg:maven/org.apache.iotdb/iotdb-grafana-connector

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0.13.0

Fixed

0.13.4

Affected versions

0.*

0.13.0

0.13.1

0.13.2

0.13.3

PyPI / apache-iotdb