CVE-2023-24829 Apache IoTDB Workbench: apache/iotdb-web-workbench: forge the JWTToken to access workbench

What is CVE-2023-24829?

CVE-2023-24829 is a high-severity authentication bypass vulnerability in Apache IoTDB Workbench, published on 31 Jan 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Incorrect Authorization vulnerability in Apache Software Foundation Apache IoTDB.This issue affects the iotdb-web-workbench component from 0.13.0 before 0.13.3. iotdb-web-workbench is an optional component of IoTDB, providing a web console of the database.

This problem is fixed from version 0.13.3 of iotdb-web-workbench onwards.

Weakness: CWE-863

Which versions are affected by CVE-2023-24829?

1 open source package ship an affected version, including apache-iotdb. It affects 1 product.

Products include Apache Iotdb.

How do I fix CVE-2023-24829?

Upgrade apache-iotdb to 0.13.3 or later.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2023-24829 being exploited?

There is no known exploitation of CVE-2023-24829 in the wild and no public exploit code.

Other vulnerabilities in Apache IoTDB Workbench

• CVE-2026-24014 Apache IoTDB: Path Traversal in DataNode Internal RPC Trigger JAR Upload Allows Arbitrary File Write Critical 9.8
• CVE-2026-24015 Apache IoTDB: Insecure Default Configuration Vulnerability Critical 9.8
• CVE-2026-24713 Apache IoTDB: JEXL Expression Injection Vulnerability Critical 9.8
• CVE-2024-24780 Apache IoTDB: Remote Code Execution with untrusted URI of User-defined function Critical 9.8
• CVE-2023-46226 Apache IoTDB: Remote Code Execution (RCE) risk via the UDF Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-98mx-4vv7-3pq6, PYSEC-2023-5.