Hugegraph
Monthly
RCE-Remote Command Execution vulnerability in Apache HugeGraph-Server.0.0 before 1.3.0 in Java8 & Java11 Users are recommended to upgrade to version 1.3.0 with Java11 & enable the Auth system, which. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Remote code execution in the Apache HugeGraph PD (Placement Driver) store before 1.7.0 lets an attacker with network reachability to the internal Raft RPC endpoint inject malicious Hessian-serialized objects and execute arbitrary code on the PD node, per the independent assessment which rates the vector as AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity and availability impact. The root problem is twofold: Raft cluster membership was not restricted by IP-based authentication and Hessian deserialization had no class whitelist, so a rogue node that could reach the port could push crafted serialized payloads into the state machine. Fixes are available in Apache HugeGraph 1.7.0 (PR #2735 adds an IP whitelist channel handler and a hardened Hessian serializer factory); there is no public exploit identified at time of analysis and EPSS is low (0.89%, 58th percentile), with the main practical constraint being that the PD Raft channel is normally bound to an internal cluster network rather than the public internet.
Authentication Bypass by Assumed-Immutable Data vulnerability in Apache HugeGraph-Server.0.0 before 1.5.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Authentication Bypass by Spoofing vulnerability in Apache HugeGraph-Server.0.0 before 1.3.0. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
RCE-Remote Command Execution vulnerability in Apache HugeGraph-Server.0.0 before 1.3.0 in Java8 & Java11 Users are recommended to upgrade to version 1.3.0 with Java11 & enable the Auth system, which. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Remote code execution in the Apache HugeGraph PD (Placement Driver) store before 1.7.0 lets an attacker with network reachability to the internal Raft RPC endpoint inject malicious Hessian-serialized objects and execute arbitrary code on the PD node, per the independent assessment which rates the vector as AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity and availability impact. The root problem is twofold: Raft cluster membership was not restricted by IP-based authentication and Hessian deserialization had no class whitelist, so a rogue node that could reach the port could push crafted serialized payloads into the state machine. Fixes are available in Apache HugeGraph 1.7.0 (PR #2735 adds an IP whitelist channel handler and a hardened Hessian serializer factory); there is no public exploit identified at time of analysis and EPSS is low (0.89%, 58th percentile), with the main practical constraint being that the PD Raft channel is normally bound to an internal cluster network rather than the public internet.
Authentication Bypass by Assumed-Immutable Data vulnerability in Apache HugeGraph-Server.0.0 before 1.5.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Authentication Bypass by Spoofing vulnerability in Apache HugeGraph-Server.0.0 before 1.3.0. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.