CVE-2024-43441

Authentication Bypass by Assumed-Immutable Data vulnerability in Apache HugeGraph-Server.

This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.5.0.

Users are recommended to upgrade to version 1.5.0, which fixes the issue.

Weakness

The authentication scheme or implementation uses key data elements that are assumed to be immutable, but can be controlled or modified by the attacker.

Potential Mitigations

Related Attack Patterns

• https://cwe.mitre.org/data/definitions/10.html
• https://cwe.mitre.org/data/definitions/13.html
• https://cwe.mitre.org/data/definitions/21.html
• https://cwe.mitre.org/data/definitions/274.html
• https://cwe.mitre.org/data/definitions/31.html
• https://cwe.mitre.org/data/definitions/39.html
• https://cwe.mitre.org/data/definitions/45.html
• https://cwe.mitre.org/data/definitions/77.html

References

• https://lists.apache.org/thread/h2607yv32wgcrywov960jpxhvsmmlf12
• http://www.openwall.com/lists/oss-security/2024/12/24/2