by Kastro
Paper/Archive/CVE-2020-1952

CVE-2020-1952

Apache IoTDB — An issue was found in Apache IoTDB .9.0 to 0.9.1 and 0.8.0 to 0.8.2.

EPSS 3%CVSS 9.8
critical.is priorityof 100
47
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 85.8.858 × 2017.2No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

An issue was found in Apache IoTDB .9.0 to 0.9.1 and 0.8.0 to 0.8.2. When starting IoTDB, the JMX port 31999 is exposed with no certification.Then, clients could execute code remotely.

Affected

ProductAffectedFixed inSource
IoTDB0.9.0 to 0.9.1–CNA
IoTDB0.8.0 to 0.8.2–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

reflists.apache.org/thread.html/r3d2ff899ead64d2952fdc1fbb1f520ca42011ed2b4c7f786e921f6b9%40%3Cdev.iotdb.apache.org%3E