CVE-2024-27347

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Server-Side Request Forgery (SSRF) vulnerability in Apache HugeGraph-Hubble.This issue affects Apache HugeGraph-Hubble: from 1.0.0 before 1.3.0.

Users are recommended to upgrade to version 1.3.0, which fixes the issue.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-918

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache HugeGraph-Hubble	>= 1.0.0, < 1.3.0
apache	hugegraph-hubble	1.0.0

References

http://www.openwall.com/lists/oss-security/2024/04/22/2Mailing List, Third Party Advisory
https://lists.apache.org/thread/z0v71148slfkw60hsp35pl7ddjyvg01lMailing List, Vendor Advisory
http://www.openwall.com/lists/oss-security/2024/04/22/2Mailing List, Third Party Advisory
https://lists.apache.org/thread/z0v71148slfkw60hsp35pl7ddjyvg01lMailing List, Vendor Advisory

Timeline

Published: Apr 22, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-273489.8RCE-Remote Command Execution vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0 in CVE-2024-273499.1Authentication Bypass by Spoofing vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3 CVE-2024-27355.4The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Price List' element in all versions up to, CVE-2024-273505.9Amazon Fire OS 7 before 7.6.6.9 and 8 before 8.1.0.3 allows Fire TV applications to establish local ADB (Android Debug Bridge) connections. CVE-2024-273515.3In Django 3.2 before 3.2.25, 4.2 before 4.2.11, and 5.0 before 5.0.3, the django.utils.text.Truncator.words() method (with html=True) and th CVE-2024-273537.4A memory corruption vulnerability in SdHost and SdMmcDevice in Insyde InsydeH2O kernel 5.2 before 05.29.09, kernel 5.3 before 05.38.09, kern CVE-2024-273547.5An issue was discovered in phpseclib 1.x before 1.0.23, 2.x before 2.0.47, and 3.x before 3.0.36. An attacker can construct a malformed cert CVE-2024-273557.5An issue was discovered in phpseclib 1.x before 1.0.23, 2.x before 2.0.47, and 3.x before 3.0.36. When processing the ASN.1 object identifie CVE-2024-273567.5An issue was discovered on certain GL-iNet devices. Attackers can download files such as logs via commands, potentially obtaining critical u CVE-2024-273575.8An issue was discovered in WithSecure Elements Agent through 23.x for macOS, WithSecure Elements Client Security through 23.x for macOS, and CVE-2024-273583.3An issue was discovered in WithSecure Elements Agent through 23.x for macOS and WithSecure Elements Client Security through 23.x for macOS. CVE-2024-273597.5Certain WithSecure products allow a Denial of Service because the engine scanner can go into an infinite loop when processing an archive fil