Vulnerability · Published Aug 5, 2024 · Assigned by apache

CVE-2024-36448Apache IoTDB Workbench: SSRF Vulnerability (EOL)

High 7.3

In plain English

A high-severity server-side request forgery in Apache IoTDB Workbench from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities).

Severity (CVSS 3.1)7.3High

Exploit odds (30 days)0.7%top 46.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

** UNSUPPORTED WHEN ASSIGNED ** Server-Side Request Forgery (SSRF) vulnerability in Apache IoTDB Workbench. This issue affects Apache IoTDB Workbench: from 0.13.0. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

Affected products (as reported)

Vendor	Product	Versions
Apache Software Foundation	Apache IoTDB Workbench	0.13.0 – through *

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

In plain English

Official description

Affected products (as reported)

References