CVE-2024-27348criticalunder attackCWE-284

CVE-2024-27348: critical vulnerability in Apache HugeGraph-Server

Apache HugeGraph-Server: Command execution in gremlin

Published · Updated

Follow this CVE+ Monitor Apache HugeGraph-Server+ Monitor org.apache.hugegraph:hugegraph-api

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.8epss 99%
from disclosure to weapon39 days
Published on NVDApr 22
1st PoC+39d
metasploitApr 22
CISA KEV+149d
Action required by CISAfederal deadline: 2024-10-09

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

In short

Apache HugeGraph-Server allows attackers to execute arbitrary commands on the server through the Gremlin query interface without authentication. This is a critical flaw that can lead to complete system compromise.

Technical detail

Remote Code Execution vulnerability in Apache HugeGraph-Server versions 1.0.0 through 1.2.x exploitable via unauthenticated Gremlin query submission. The vulnerability stems from insufficient input validation in the Gremlin execution handler (CWE-284: Improper Access Control), allowing authenticated or network-adjacent attackers to execute arbitrary OS commands with server privileges.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

RCE-Remote Command Execution vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0 in Java8 & Java11 Users are recommended to upgrade to version 1.3.0 with Java11 & enable the Auth system, which fixes the issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Apache Software Foundation · Apache HugeGraph-Server
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Apache HugeGraph-Server

In the same product, most dangerous first.

CVE-2024-43441CRITICALApache HugeGraph-Server: Fixed JWT Token(Secret)EPSS 73.1%CVE-2025-26866HIGHApache HugeGraph-Server: RAFT and deserialization vulnerabilityEPSS 1.0%CVE-2024-27349CRITICALApache HugeGraph-Server: Bypass whitelist in Auth modeEPSS 1.0%