Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2024-43441

CWE-3025 documents5 sources
Severity
9.8CRITICAL
EPSS
90.2%
top 0.41%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
2
Apache Software Foundation Apache Hugegraph-serverApache Hugegraph
Timeline
PublishedDec 24

Description

Authentication Bypass by Assumed-Immutable Data vulnerability in Apache HugeGraph-Server. This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.5.0. Users are recommended to upgrade to version 1.5.0, which fixes the issue.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages3 packages

▶NVDapache/hugegraph1.0.0 — 1.5.0

🔴Vulnerability Details

3
GHSA
Apache HugeGraph-Server: Fixed JWT Token (Secret)↗2024-12-24
▶
CVEList
Apache HugeGraph-Server: Fixed JWT Token(Secret)↗2024-12-24
▶
OSV
Apache HugeGraph-Server: Fixed JWT Token (Secret)↗2024-12-24
▶

💥Exploits & PoCs

1
Nuclei
Apache HugeGraph-Server <1.5.0 - Authentication Bypass
▶
CVE-2024-43441 (CRITICAL CVSS 9.8) | Authentication Bypass by Assumed-Im | cvebase.io