Lucene search

GoogleOSV:PYSEC-2023-8

HistoryApr 17, 2023 - 8:15 a.m.

PYSEC-2023-8

2023-04-1708:15:00

Google

osv.dev

apache software foundation

iotdb

authorization

vulnerability

iotdb-web-workbench

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.1 High

AI Score

Confidence

High

0.082 Low

EPSS

Percentile

94.4%

JSON

Incorrect Authorization vulnerability in Apache Software Foundation Apache IoTDB.This issue affects the iotdb-web-workbench component on 0.13.3. iotdb-web-workbench is an optional component of IoTDB, providing a web console of the database.

This problem is fixed from version 0.13.4 of iotdb-web-workbench onwards.

CPENameOperatorVersion
apache-iotdbeq0.12.0
apache-iotdbeq0.9.0
apache-iotdbeq0.13.1
apache-iotdbeq0.11.0
apache-iotdbeq1.1.0
apache-iotdbeq0.11.3
apache-iotdbeq0.14.0rc1
apache-iotdbeq0.11.4
apache-iotdbeq0.12.1
apache-iotdbeq0.13.0

Name	Operator	Version
apache-iotdb	eq	0.12.0
apache-iotdb	eq	0.9.0
apache-iotdb	eq	0.13.1
apache-iotdb	eq	0.11.0
apache-iotdb	eq	1.1.0
apache-iotdb	eq	0.11.3
apache-iotdb	eq	0.14.0rc1
apache-iotdb	eq	0.11.4
apache-iotdb	eq	0.12.1
apache-iotdb	eq	0.13.0

Rows per page:

1-10 of 281

References

www.openwall.com/lists/oss-security/2023/04/18/7

lists.apache.org/thread/08nc3dr6lshfppx0pzmz5vbggdnzpojb

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.1 High

AI Score

Confidence

High

0.082 Low

EPSS

Percentile

94.4%

JSON

Related for OSV:PYSEC-2023-8