Yan Nan

**Name of the Vulnerable Software and Affected Versions** Apache IoTDB versions 1.3.3 through 2.0.7 **Description** An uncontrolled resource consumption issue exists where certain interfaces do not impose reasonable limits on the time span and aggregation interval of queries. An attacker can send a request using extreme parameters, such as a very large time range combined with a minimal interval, forcing the DataNode to build an enormous result set in memory. This leads to Java heap exhaustion and causes the DataNode process to crash. **Recommendations** Upgrade to version 2.0.8.

**Name of the Vulnerable Software and Affected Versions** Apache IoTDB versions 1.3.3 through 2.0.7 **Description** An authentication bypass issue exists due to insufficient validation of the `sessionId` parameter within certain Thrift RPC query handlers. An attacker can forge the `sessionId` to bypass the openSession authentication process, allowing unauthorized access to and reading of time-series data. **Recommendations** Upgrade to version 2.0.8.

**Name of the Vulnerable Software and Affected Versions** Apache IoTDB versions 1.3.3 through 2.0.7 **Description** The internal RPC interface of the Apache IoTDB DataNode used for creating Trigger instances fails to sufficiently validate the name of the uploaded Trigger JAR when building a file path. If the internal DataNode RPC port is exposed to an untrusted network, an attacker can use path traversal sequences in the JAR name to write files outside the designated Trigger installation directory. This allows for arbitrary file write operations with the permissions of the IoTDB process. **Recommendations** Upgrade to version 2.0.8.

**Name of the Vulnerable Software and Affected Versions** Apache IoTDB versions 1.0.0 through 1.3.5 Apache IoTDB versions 2.0.0 through 2.0.6 **Description** Improper Limitation of a Pathname to a Restricted Directory, also known as Path Traversal, allows access to files or directories outside the intended restricted folder. **Recommendations** Upgrade to version 1.3.6. Upgrade to version 2.0.7.