Lucene search

Veracode Vulnerability DatabaseVERACODE:46588

HistoryApr 23, 2024 - 8:00 a.m.

Remote Code Execution

2024-04-2308:00:00

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

remote code execution

org.apache.hugegraph

input validation

java8

java11

vulnerability

8 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

36.9%

JSON

org.apache.hugegraph:hugegraph-api and org.apache.hugegraph:hugegraph-core are vulnerable to Remote Code Execution.The vulnerability is due to improper input validation, allowing attackers to execute arbitrary commands remotely. This vulnerability is observed in Java8 and Java11.

CPENameOperatorVersion
hugegraph-apile1.2.0
hugegraph-corele1.2.0
hugegraph-apile1.2.0
hugegraph-corele1.2.0

Name	Operator	Version
hugegraph-api	le	1.2.0
hugegraph-core	le	1.2.0
hugegraph-api	le	1.2.0
hugegraph-core	le	1.2.0

References

www.openwall.com/lists/oss-security/2024/04/22/3

github.com/advisories/GHSA-29rc-vq7f-x335

github.com/apache/incubator-hugegraph/commit/713d88d1fd9953c3c3e3f130389501910ba40e1d

hugegraph.apache.org/docs/config/config-authentication/#configure-user-authentication

lists.apache.org/thread/nx6g6htyhpgtzsocybm242781o8w5kq9