CVSS 3.1
9.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2024-24780
Critical (9.8) in apache iotdb. EPSS 1.4% chance of exploitation in the next 30 days. Fixed in org.apache.iotdb:iotdb-core 1.3.4.
Remote Code Execution with untrusted URI of UDF vulnerability in Apache IoTDB. The attacker who has privilege to create UDF can register malicious function from untrusted URI.
This issue affects Apache IoTDB: from 1.0.0 before 1.3.4.
Users are recommended to upgrade to version 1.3.4, which fixes the issue.
Severity
- EPSS
- 1.4% chance of exploitation in the next 30 days; higher than 73% of CVEs (scores of 2026-10-31)
- CWE
- CWE-94
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apache:iotdb
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-f4rq-f4j9-f6rm | Maven | org.apache.iotdb:iotdb-core | >=1.0.0 <1.3.4 | 1.3.4 |
| GHSA-f4rq-f4j9-f6rm | PyPI | apache-iotdb | >=1.0.0 <1.3.4 | 1.3.4 |
| PYSEC-2025-59 | PyPI | apache-iotdb | >=1.0.0 <1.3.4 | 1.3.4 |