CVE-2022-38370 No authorization of DatabaseConnectController in grafana-connector.

What is CVE-2022-38370?

CVE-2022-38370 is a high-severity missing authorization vulnerability in Apache IoTDB, published on 5 Sep 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Apache IoTDB grafana-connector version 0.13.0 contains an interface without authorization, which may expose the internal structure of database. Users should upgrade to version 0.13.1 which addresses this issue.

Weakness: CWE-862

Which versions are affected by CVE-2022-38370?

2 open source packages ship an affected version, including org.apache.iotdb:iotdb-grafana-connector. It affects 1 product.

Products include Apache Iotdb.

How do I fix CVE-2022-38370?

Upgrade org.apache.iotdb:iotdb-grafana-connector to 0.13.1 or later.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2022-38370 being exploited?

There is no known exploitation of CVE-2022-38370 in the wild and no public exploit code.

Other vulnerabilities in Apache IoTDB

• CVE-2026-24014 Apache IoTDB: Path Traversal in DataNode Internal RPC Trigger JAR Upload Allows Arbitrary File Write Critical 9.8
• CVE-2026-24015 Apache IoTDB: Insecure Default Configuration Vulnerability Critical 9.8
• CVE-2026-24713 Apache IoTDB: JEXL Expression Injection Vulnerability Critical 9.8
• CVE-2024-24780 Apache IoTDB: Remote Code Execution with untrusted URI of User-defined function Critical 9.8
• CVE-2023-46226 Apache IoTDB: Remote Code Execution (RCE) risk via the UDF Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-c86f-9grv-pmqf.