RCE-Remote Command Execution vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0 in Java8 & Java11 Users are recommended to upgrade to version 1.3.0 with Java11 & enable the Auth system, which fixes the issue.

Researchers have observed in-the-wild exploitation attempts targeting this Apache HugeGraph-Server flaw. Monitoring for additional insights.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - RCE-Remote Command Execution vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-
    Server: from 1.0.0 before 1.3.0 in Java8 & Java11 Users are recommended to upgrade to version 1.3.0 with
    Java11 & enable the Auth system, which fixes the issue. (CVE-2024-27348)

The version of Apache HugeGraph Server installed on the remote host is prior to 1.3.0. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-27348 advisory.

  - RCE-Remote Command Execution vulnerability in Apache HugeGraph-Server. This issue affects Apache     HugeGraph-Server: from 1.0.0 before 1.3.0 in Java8 & Java11 Users are recommended to upgrade to version     1.3.0 with Java11 & enable the Auth system, which fixes the issue. (CVE-2024-27348)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Apache Hugegraph versions 1.0.0 prior to 1.3.0 is affected by a vulnerability allowing an unauthenticated attacker to execute remote commands via a specially forged request.

ID	Name	Product	Family	Type	Severity
408833	SCA: security update for org.apache.hugegraph:hugegraph-api, org.apache.hugegraph:hugegraph-core (GHSA-29rc-vq7f-x335)	Tenable Cloud Security	SCA Checks	Local	critical
408833	SCA: security update for org.apache.hugegraph:hugegraph-api, org.apache.hugegraph:hugegraph-core (GHSA-29rc-vq7f-x335)	Tenable Self-Hosted Container Security	SCA Checks	Local	critical
209671	Apache HugeGraph Server 1.0.x < 1.3.0 (CVE-2024-27348)	Nessus	CGI abuses	Remote	critical
114381	Apache Hugegraph 1.0.0 < 1.3.0 Remote Command Execution	Web App Scanning	Component Vulnerability	Check Based	critical

Detections

Analytics

CVE-2024-27348

critical

Tenable Plugins

critical

critical

critical

critical