CVE-2024-27348: Apache HugeGraph-Server: Command execution in gremlin
(updated )
RCE-Remote Command Execution vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0 in Java8 & Java11
Users are recommended to upgrade to version 1.3.0 with Java11 & enable the Auth system, which fixes the issue.
References
- github.com/advisories/GHSA-29rc-vq7f-x335
- github.com/apache/incubator-hugegraph
- github.com/apache/incubator-hugegraph/commit/713d88d1fd9953c3c3e3f130389501910ba40e1d
- hugegraph.apache.org/docs/config/config-authentication/
- lists.apache.org/thread/nx6g6htyhpgtzsocybm242781o8w5kq9
- nvd.nist.gov/vuln/detail/CVE-2024-27348
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-27348
- www.vicarius.io/vsociety/posts/remote-code-execution-vulnerability-in-apache-hugegraph-server-cve-2024-27348
Code Behaviors & Features
Detect and mitigate CVE-2024-27348 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →