org.apache.hugegraph/hugegraph-api vulnerabilities

Latest org.apache.hugegraph/hugegraph-api CVEs

Newest publication first

1. CVE-2024-27349 Apache HugeGraph-Server: Bypass whitelist in Auth mode

   Published 2024-04-22

   Critical·CVSS 9.1

   Authentication Bypass by Spoofing vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0. Users are recommended to upgrade to version 1.3.0, which fixes the issue.

2. CVE-2024-27348 Apache HugeGraph-Server: Command execution in gremlin

   Published 2024-04-22

   Critical·CVSS 9.8 EPSS 99.2% CISA KEV added 2024-09-18 Exploited in the wild Framework module Public exploit

   RCE-Remote Command Execution vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0 in Java8 & Java11 Users are recommended to upgrade to version 1.3.0 with Java11 & enable the Auth system, which fixes the issue.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.