PT-2025-21135

CVE-2024-24780

Published

2025-05-14

Updated

2025-05-19

Description by

CVSS 3.1

9.8

Critical

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Apache IoTDB versions 1.0.0 through 1.3.3

Description: The issue is related to a Remote Code Execution vulnerability with untrusted URI of UDF in Apache IoTDB. An attacker with privilege to create UDF can register a malicious function from an untrusted URI.

Recommendations: For Apache IoTDB versions 1.0.0 through 1.3.3, upgrade to version 1.3.4, which fixes the issue. As a temporary workaround, consider restricting the creation of UDFs to trusted sources until the upgrade is applied.

Exploitability

Exploit

Fix

Impacts

Researchers

Nbxiglk

Y4 Tacker

Vendors

Affected products

Weakness enumeration

CWE-94: Improper Control of Generation of Code (\'Code Injection\')

Related identifiers