CVE-2024-27348

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

RCE-Remote Command Execution vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0 in Java8 & Java11

Users are recommended to upgrade to version 1.3.0 with Java11 & enable the Auth system, which fixes the issue.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-284

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache HugeGraph-Server	>= 1.0.0, < 1.3.0
apache	hugegraph-server	>= 1.0.0, < 1.3.0

References

http://www.openwall.com/lists/oss-security/2024/04/22/3Mailing List, Third Party Advisory
https://hugegraph.apache.org/docs/config/config-authentication/#configure-user-authenticationProduct
https://lists.apache.org/thread/nx6g6htyhpgtzsocybm242781o8w5kq9Mailing List, Vendor Advisory
http://www.openwall.com/lists/oss-security/2024/04/22/3Mailing List, Third Party Advisory
https://hugegraph.apache.org/docs/config/config-authentication/#configure-user-authenticationProduct
https://lists.apache.org/thread/nx6g6htyhpgtzsocybm242781o8w5kq9Mailing List, Vendor Advisory
https://www.vicarius.io/vsociety/posts/remote-code-execution-vulnerability-in-apache-hugegraph-server-cve-2024-27348Exploit, Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-27348Third Party Advisory, US Government Resource

Timeline

Published: Apr 22, 2024
Last modified: Jun 17, 2026
Added to CISA KEV: Sep 18, 2024
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-273499.1Authentication Bypass by Spoofing vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3 CVE-2024-27355.4The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Price List' element in all versions up to, CVE-2024-273505.9Amazon Fire OS 7 before 7.6.6.9 and 8 before 8.1.0.3 allows Fire TV applications to establish local ADB (Android Debug Bridge) connections. CVE-2024-273515.3In Django 3.2 before 3.2.25, 4.2 before 4.2.11, and 5.0 before 5.0.3, the django.utils.text.Truncator.words() method (with html=True) and th CVE-2024-273537.4A memory corruption vulnerability in SdHost and SdMmcDevice in Insyde InsydeH2O kernel 5.2 before 05.29.09, kernel 5.3 before 05.38.09, kern CVE-2024-273547.5An issue was discovered in phpseclib 1.x before 1.0.23, 2.x before 2.0.47, and 3.x before 3.0.36. An attacker can construct a malformed cert CVE-2024-273557.5An issue was discovered in phpseclib 1.x before 1.0.23, 2.x before 2.0.47, and 3.x before 3.0.36. When processing the ASN.1 object identifie CVE-2024-273567.5An issue was discovered on certain GL-iNet devices. Attackers can download files such as logs via commands, potentially obtaining critical u CVE-2024-273575.8An issue was discovered in WithSecure Elements Agent through 23.x for macOS, WithSecure Elements Client Security through 23.x for macOS, and CVE-2024-273583.3An issue was discovered in WithSecure Elements Agent through 23.x for macOS and WithSecure Elements Client Security through 23.x for macOS. CVE-2024-273597.5Certain WithSecure products allow a Denial of Service because the engine scanner can go into an infinite loop when processing an archive fil CVE-2024-27365.4The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTML Tags in all versions up to, and including,