Analysis Summary

CVE-2024-27349 CVSS:7.5

Apache HugeGraph-Server could allow a remote attacker to bypass security restrictions, caused by an authentication bypass by spoofing. By sending a specially crafted request, an attacker could exploit this vulnerability to bypass whitelist in Auth mode.

CVE-2024-27348 CVSS:9.8

Apache HugeGraph-Server could allow a remote attacker to execute arbitrary commands on the system, caused by a command injection flaw in gremlin. By sending a specially crafted request, an attacker could exploit this vulnerability to execute arbitrary commands on the system.

CVE-2024-27347 CVSS:7.5

Apache HugeGraph-Hubble is vulnerable to server-side request forgery, caused by a flaw in the Hubble connection page. By using a specially crafted argument, an attacker could exploit this vulnerability to conduct SSRF attack.

Impact

• Gain Access
• Security Bypass

Indicators of Compromise

CVE

• CVE-2024-27349
• CVE-2024-27348
• CVE-2024-27347

Affected Vendors

Remediation

Upgrade to the latest version of Apache HugeGraph, available from the Apache Website.

Apache Website