org.apache.iotdb/iotdb-parent vulnerabilities

Latest org.apache.iotdb/iotdb-parent CVEs

Newest publication first

1. CVE-2023-51656 Apache IoTDB: Unsafe deserialize map in Sync Tool

   Published 2023-12-21

   Critical·CVSS 9.8

   Deserialization of Untrusted Data vulnerability in Apache IoTDB.This issue affects Apache IoTDB: from 0.13.0 through 0.13.4. Users are recommended to upgrade to version 1.2.2, which fixes the issue.

2. CVE-2023-24830 Apache IoTDB Workbench: apache/iotdb-web-workbench: create a user without authorization

   Published 2023-01-30

   High·CVSS 7.5

   Improper Authentication vulnerability in Apache Software Foundation Apache IoTDB.This issue affects iotdb-web-workbench component: from 0.13.0 before 0.13.3.

3. CVE-2020-1952 Improper Certificate Validation in Apache IoTDB

   Published 2020-04-27

   Critical·CVSS 9.8 EPSS 2.7%

   An issue was found in Apache IoTDB .9.0 to 0.9.1 and 0.8.0 to 0.8.2. When starting IoTDB, the JMX port 31999 is exposed with no certification.Then, clients could execute code remotely.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.