ZeroDay Findings
Sign inSign up

Findings

CVE-2024-27348

Apache HugeGraph-Server Improper Access Control Vulnerability

Published Apr 22, 2024 · updated Jun 17, 2026 · apache hugegraph

RCE-Remote Command Execution vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0 in Java8 & Java11 Users are recommended to upgrade to version 1.3.0 with Java11 & enable the Auth system, which fixes the issue.

Timeline

Detection, updates, and resolution for this record.

  1. Apr 22, 2024 · Catalog

    Detected

    RCE-Remote Command Execution vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0 in Java8 & Java11 Users are recommended to upgrade to version 1.3.0 with Java11 & enable the Auth system, which fixes the issue.

  2. Sep 18, 2024 · CISA KEV

    Known exploited

    Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

  3. Oct 9, 2024 · CISA KEV

    Remediation due

    Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

  4. Jun 17, 2026 · Catalog

    Updated

    RCE-Remote Command Execution vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0 in Java8 & Java11 Users are recommended to upgrade to version 1.3.0 with Java11 & enable the Auth system, which fixes the issue.

Required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CISA due date Oct 9, 2024

Affected

  • cpe apache/hugegraphversion unspecified
  • vendor Apache HugeGraph-Serverversion unspecified

Sources

  • CISA KEVCVE-2024-27348

    Apache HugeGraph-Server contains an improper access control vulnerability that could allow a remote attacker to execute arbitrary code.

    cisa.gov
  • CVE.orgCVE-2024-27348

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2024-27348

    30-day exploitation probability 99.2%

    first.org
  • Exploit Database52149

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • Metasploit Modulesexploit_linux/http/apache_hugegraph_gremlin_rce

    Public module reference (excellent). Module source is not copied into this catalog.

    rapid7.com
  • NIST NVDCVE-2024-27348

    RCE-Remote Command Execution vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0 in Java8 & Java11 Users are recommended to upgrade to version 1.3.0 with Java11 & enable the Auth system, which fixes the issue.

    nvd.nist.gov

References