What is GHSA-wc6f-cjcp-cc33?

GHSA-wc6f-cjcp-cc33 is a security advisory published by GitHub Security Advisories with High severity. Improper Certificate Validation in Apache IoTDB

Which CVE IDs does GHSA-wc6f-cjcp-cc33 cover?

GHSA-wc6f-cjcp-cc33 covers the following CVE IDs: CVE-2020-1952. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-wc6f-cjcp-cc33?

GHSA-wc6f-cjcp-cc33 has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-wc6f-cjcp-cc33?

GHSA-wc6f-cjcp-cc33 affects 1 product, including: maven/org.apache.iotdb:iotdb-parent:\u003c 0.9.2.

GHSA-wc6f-cjcp-cc33HighCVSS 9.8

Improper Certificate Validation in Apache IoTDB

Vendor

GitHub Security Advisories

Published

January 6, 2022

Last Modified

February 1, 2023

🔗 CVE IDs covered (1)

CVE-2020-1952 →

📋 Description

An issue was found in Apache IoTDB .9.0 to 0.9.1 and 0.8.0 to 0.8.2. When starting IoTDB, the JMX port 31999 is exposed with no certification.Then, clients could execute code remotely.

🎯 Affected products1

maven/org.apache.iotdb:iotdb-parent:< 0.9.2

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2020-1952
https://lists.apache.org/thread.html/r3d2ff899ead64d2952fdc1fbb1f520ca42011ed2b4c7f786e921f6b9%40%3Cdev.iotdb.apache.org%3E
https://github.com/advisories/GHSA-wc6f-cjcp-cc33