CVE-2022-38370

CVE-2022-38370: vulnerability in Apache IoTDB

No authorization of DatabaseConnectController in grafana-connector.

Published · Updated

Follow this CVE+ Monitor Apache IoTDB+ Monitor org.apache.iotdb:iotdb-grafana-connector

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

3Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 1.4%
Apache IoTDB grafana-connector version 0.13.0 contains an interface without authorization, which may expose the internal structure of database. Users should upgrade to version 0.13.1 which addresses this issue.
Affected products
Apache Software Foundation · Apache IoTDB
Related CVEs — Apache IoTDB

In the same product, most dangerous first.

CVE-2023-46226CRITICALApache IoTDB: Remote Code Execution (RCE) risk via the UDFEPSS 1.9%CVE-2022-43766HIGHApache IoTDB prior to 0.13.3 allows DoSEPSS 1.6%CVE-2024-24780CRITICALApache IoTDB: Remote Code Execution with untrusted URI of User-defined functionEPSS 1.4%CVE-2022-38369—Login check vulnerability by session IdEPSS 1.3%CVE-2023-24831CRITICALApache IoTDB grafana-connector Login Bypass VulnerabilityEPSS 1.2%CVE-2023-51656—Apache IoTDB: Unsafe deserialize map in Sync ToolEPSS 1.0%