CVE-2024-27348

Apache Software Foundation Apache HugeGraph-Server, apache hugegraph-server

Published 22 Apr 2024 · updated 17 Jun 2026 · Analyzed

9.8 Critical · CVSS 3.1, NVD

Exploited in the wild

CISA added this to its Known Exploited Vulnerabilities catalog on 18 Sept 2024, with a remediation deadline of 9 Oct 2024 for US federal agencies.

Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Description

RCE-Remote Command Execution vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0 in Java8 & Java11 Users are recommended to upgrade to version 1.3.0 with Java11 & enable the Auth system, which fixes the issue.

References

www.openwall.com/lists/oss-security/2024/04/22/3 · Mailing List, Third Party Advisory
hugegraph.apache.org/docs/config/config-authentication/#configure-user-authentication · Product
lists.apache.org/thread/nx6g6htyhpgtzsocybm242781o8w5kq9 · Mailing List, Vendor Advisory
www.vicarius.io/vsociety/posts/remote-code-execution-vulnerability-in-apache-hugegraph-server-cve-2024-27348 · Exploit, Third Party Advisory
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-27348 · Third Party Advisory, US Government Resource