CVE-2023-24829

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Incorrect Authorization vulnerability in Apache Software Foundation Apache IoTDB.This issue affects the iotdb-web-workbench component from 0.13.0 before 0.13.3. iotdb-web-workbench is an optional component of IoTDB, providing a web console of the database.

This problem is fixed from version 0.13.3 of iotdb-web-workbench onwards.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-863

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache IoTDB Workbench	>= 0.13.0, < 0.13.3

References

https://lists.apache.org/thread/l0b59hh046tyn4gqot0bdrpg8gxlksmoMailing List, Vendor Advisory
https://lists.apache.org/thread/l0b59hh046tyn4gqot0bdrpg8gxlksmoMailing List, Vendor Advisory

Timeline

Published: Jan 31, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-248307.5Improper Authentication vulnerability in Apache Software Foundation Apache IoTDB.This issue affects iotdb-web-workbench component: from 0.13 CVE-2023-248319.8Improper Authentication vulnerability in Apache Software Foundation Apache IoTDB.This issue affects Apache IoTDB Grafana Connector: from 0.1 CVE-2023-248327.5A null pointer dereference bug in Hermes prior to commit 5cae9f72975cf0e5a62b27fdd8b01f103e198708 could have been used by an attacker to cra CVE-2023-248337.5A use-after-free in BigIntPrimitive addition in Hermes prior to commit a6dcafe6ded8e61658b40f5699878cd19a481f80 could have been used by an a CVE-2023-248346.5WisdomGarden Tronclass has improper access control when uploading file. An authenticated remote attacker with general user privilege can exp CVE-2023-248357.2Softnext Technologies Corp.’s SPAM SQR has a vulnerability of Code Injection within its specific function. An authenticated remote attacker CVE-2023-248368.8SUNNET CTMS has vulnerability of path traversal within its file uploading function. An authenticated remote attacker with general user privi CVE-2023-248378.8HGiga PowerStation remote management function has insufficient filtering for user input. An authenticated remote attacker with general user CVE-2023-248389.8HGiga PowerStation has a vulnerability of Information Leakage. An unauthenticated remote attacker can exploit this vulnerability to obtain t CVE-2023-248396.1HGiga MailSherlock’s specific function has insufficient filtering for user input. An unauthenticated remote attacker can exploit this vulner CVE-2023-24844.9The Active Directory Integration plugin for WordPress is vulnerable to time-based SQL Injection via the orderby and order parameters in vers CVE-2023-248407.2HGiga MailSherlock mail query function has vulnerability of insufficient validation for user input. An authenticated remote attacker with ad