CVE-2024-27349: Apache HugeGraph-Server: Bypass allow-list in Auth mode

April 22, 2024 (updated February 13, 2025)

Authentication Bypass by Spoofing vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0.

Users are recommended to upgrade to version 1.3.0, which fixes the issue.

References

github.com/advisories/GHSA-6mgp-p75r-vhjm
github.com/apache/incubator-hugegraph
github.com/apache/incubator-hugegraph/commit/713d88d1fd9953c3c3e3f130389501910ba40e1d
lists.apache.org/thread/dz9n9lndqfsf64t72o73r7sttrc6ocsd
nvd.nist.gov/vuln/detail/CVE-2024-27349

Code Behaviors & Features

Detect and mitigate CVE-2024-27349 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →