CVE-2020-1952
published 2020-04-27CVE-2020-1952: An issue was found in Apache IoTDB .9.0 to 0.9.1 and 0.8.0 to 0.8.2. When starting IoTDB, the JMX port 31999 is exposed with no certification.Then, clients…
PriorityP351critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
2.68%
84.0th percentile
An issue was found in Apache IoTDB .9.0 to 0.9.1 and 0.8.0 to 0.8.2. When starting IoTDB, the JMX port 31999 is exposed with no certification.Then, clients could execute code remotely.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | iotdb | — | — |
| apache | iotdb | — | — |
| apache | iotdb | 0.8.0 – 0.8.2 | — |
| apache | iotdb | 0.9.0 – 0.9.1 | — |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Improper Certificate Validation in Apache IoTDB
ghsa·2022-01-06
CVE-2020-1952 [HIGH] CWE-295 Improper Certificate Validation in Apache IoTDB
Improper Certificate Validation in Apache IoTDB
An issue was found in Apache IoTDB .9.0 to 0.9.1 and 0.8.0 to 0.8.2. When starting IoTDB, the JMX port 31999 is exposed with no certification.Then, clients could execute code remotely.
OSV
Improper Certificate Validation in Apache IoTDB
osv·2022-01-06
CVE-2020-1952 [HIGH] Improper Certificate Validation in Apache IoTDB
Improper Certificate Validation in Apache IoTDB
An issue was found in Apache IoTDB .9.0 to 0.9.1 and 0.8.0 to 0.8.2. When starting IoTDB, the JMX port 31999 is exposed with no certification.Then, clients could execute code remotely.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2020-04-27
Published