Moole Vulnerability Database

Find real vulnerabilities before they ship

Critical

CVE-2020-1952

An issue was found in Apache IoTDB .9.0 to 0.9.1 and 0.8.0 to 0.8.2. When starting IoTDB, the JMX port 31999 is exposed with no certification.Then, clients could execute code remotely.

VectorNETWORK

PublishedApr 27, 2020, 17:15

Published Bysecurity@apache.org

Base Score

Score9.8

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

org.apache.iotdb:iotdb-parent(Maven)00.9.2N/A

References

https://lists.apache.org/thread.html/r3d2ff899ead64d2952fdc1fbb1f520ca42011ed2b4c7f786e921f6b9%40%3Cdev.iotdb.apache.org%3E

Weakness Type

CWE-295

CVSS Metrics

Base Score

9.8

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Base SeverityCritical

Version

3.1

Attack Vector (AV)

NETWORK