CVE-2022-38369 Login check vulnerability by session Id

What is CVE-2022-38369?

CVE-2022-38369 is a high-severity authentication bypass vulnerability in Apache IoTDB, published on 5 Sep 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Apache IoTDB version 0.13.0 is vulnerable by session id attack. Users should upgrade to version 0.13.1 which addresses this issue.

Weakness: CWE-384

Which versions are affected by CVE-2022-38369?

5 open source packages ship an affected version, including apache-iotdb and org.apache.iotdb:iotdb-server. It affects 1 product.

Products include Apache Iotdb.

How do I fix CVE-2022-38369?

Upgrade apache-iotdb to 0.13.1 or later.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2022-38369 being exploited?

There is no known exploitation of CVE-2022-38369 in the wild and no public exploit code.

Other vulnerabilities in Apache IoTDB

• CVE-2026-24014 Apache IoTDB: Path Traversal in DataNode Internal RPC Trigger JAR Upload Allows Arbitrary File Write Critical 9.8
• CVE-2026-24015 Apache IoTDB: Insecure Default Configuration Vulnerability Critical 9.8
• CVE-2026-24713 Apache IoTDB: JEXL Expression Injection Vulnerability Critical 9.8
• CVE-2024-24780 Apache IoTDB: Remote Code Execution with untrusted URI of User-defined function Critical 9.8
• CVE-2023-46226 Apache IoTDB: Remote Code Execution (RCE) risk via the UDF Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-g6vm-3ch8-c6jq, PYSEC-2022-43069.