CVE-2024-27349 Apache HugeGraph-Server: Bypass whitelist in Auth mode
Attackers can bypass authentication whitelists in Apache HugeGraph-Server when auth mode is enabled, allowing unauthorized access.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-27349?
CVE-2024-27349 is a critical authentication bypass vulnerability in Apache HugeGraph-Server, published on 22 Apr 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Authentication Bypass by Spoofing vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0.
Users are recommended to upgrade to version 1.3.0, which fixes the issue.
Weakness: CWE-290
Which versions are affected by CVE-2024-27349?
2 open source packages ship an affected version, including org.apache.hugegraph:hugegraph-api. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.hugegraph:hugegraph-api Maven | From 1.0.0 | 1.3.0 |
org.apache.hugegraph:hugegraph-api Maven | From 1.0.0 | 1.3.0 |
Products include Apache Hugegraph.
How do I fix CVE-2024-27349?
Upgrade org.apache.hugegraph:hugegraph-api to 1.3.0 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2024-27349 being exploited?
There is no known exploitation of CVE-2024-27349 in the wild and no public exploit code.
Other vulnerabilities in Apache HugeGraph-Server
Sources
Also known as GHSA-6mgp-p75r-vhjm.