CVE-2024-24780

Published: May 14, 2025Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Remote Code Execution with untrusted URI of UDF vulnerability in Apache IoTDB. The attacker who has privilege to create UDF can register malicious function from untrusted URI. This issue affects Apache IoTDB: from 1.0.0 before 1.3.4. Users are recommended to upgrade to version 1.3.4, which fixes the issue.

Affected (1)

Products: Apache: Iotdb

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Apache Iotdb	From 1.0.0 to 1.3.4

Related CWEs

Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

References (2)

https://lists.apache.org/thread/xphtm98v3zsk9vlpfh481m1ry2ctxvmj

Source: security@apache.org

Mailing ListVendor Advisory

http://www.openwall.com/lists/oss-security/2025/05/14/2

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing List

Timeline

No history available yet.