CVSS: 8.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-32114 – Apache ActiveMQ: Jolokia and REST API were not secured with default configuration
https://notcve.org/view.php?id=CVE-2024-32114
In Apache ActiveMQ 6.x, the default configuration doesn't secure the API web context (where the Jolokia JMX REST API and the Message REST API are located). It means that anyone can use these layers without any required authentication. Potentially, anyone can interact with the broker (using Jolokia JMX REST API) and/or produce/consume messages or purge/delete destinations (using the Message REST API). To mitigate, users can update the default conf/jetty.xml configuration file to add authentication requirement: <bean id="securityConstraintMapping" class="org.eclipse.jetty.security.ConstraintMapping"> <property name="constraint" ref="securityConstraint" /> <property name="pathSpec" value="/" /> </bean> Or we encourage users to upgrade to Apache ActiveMQ 6.1.2 where the default configuration has been updated with authentication by default. En Apache ActiveMQ 6.x, la configuración predeterminada no protege el contexto web de la API (donde se encuentran la API REST de Jolokia JMX y la API REST de mensajes). Significa que cualquiera puede utilizar estas capas sin necesidad de autenticación. Potencialmente, cualquiera puede interactuar con el corredor (usando la API REST de Jolokia JMX) y/o producir/consumir mensajes o purgar/eliminar destinos (usando la API REST de mensajes). • https://activemq.apache.org/security-advisories.data/CVE-2024-32114-announcement.txt • CWE-1188: Initialization of a Resource with an Insecure Default •
CVSS: 0EPSS: 0%CPEs: 1EXPL: 0CVE-2024-27349 – Apache HugeGraph-Server: Bypass whitelist in Auth mode
https://notcve.org/view.php?id=CVE-2024-27349
Authentication Bypass by Spoofing vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0. Users are recommended to upgrade to version 1.3.0, which fixes the issue. Vulnerabilidad de omisión de autenticación mediante suplantación de identidad en Apache HugeGraph-Server. Este problema afecta a Apache HugeGraph-Server: desde 1.0.0 antes de 1.3.0. Se recomienda a los usuarios actualizar a la versión 1.3.0, que soluciona el problema. • http://www.openwall.com/lists/oss-security/2024/04/22/4 https://lists.apache.org/thread/dz9n9lndqfsf64t72o73r7sttrc6ocsd • CWE-290: Authentication Bypass by Spoofing •
CVSS: 9.8EPSS: 96%CPEs: 1EXPL: 3CVE-2024-27348 – Apache HugeGraph-Server Improper Access Control Vulnerability
https://notcve.org/view.php?id=CVE-2024-27348
RCE-Remote Command Execution vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0 in Java8 & Java11 Users are recommended to upgrade to version 1.3.0 with Java11 & enable the Auth system, which fixes the issue. Vulnerabilidad de ejecución remota de comandos RCE en Apache HugeGraph-Server. Este problema afecta a Apache HugeGraph-Server: desde 1.0.0 antes de 1.3.0 en Java8 y Java11. Se recomienda a los usuarios actualizar a la versión 1.3.0 con Java11 y habilitar el sistema de autenticación lo que soluciona el problema. Apache HugeGraph versions 1.0.0 and up to 1.3.0 suffer from a remote command execution vulnerability. • https://github.com/Zeyad-Azima/CVE-2024-27348 https://github.com/kljunowsky/CVE-2024-27348 https://github.com/jakabakos/CVE-2024-27348-Apache-HugeGraph-RCE http://www.openwall.com/lists/oss-security/2024/04/22/3 https://hugegraph.apache.org/docs/config/config-authentication/#configure-user-authentication https://lists.apache.org/thread/nx6g6htyhpgtzsocybm242781o8w5kq9 • CWE-284: Improper Access Control •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-27347 – Apache HugeGraph-Hubble: SSRF in Hubble connection page
https://notcve.org/view.php?id=CVE-2024-27347
Server-Side Request Forgery (SSRF) vulnerability in Apache HugeGraph-Hubble.This issue affects Apache HugeGraph-Hubble: from 1.0.0 before 1.3.0. Users are recommended to upgrade to version 1.3.0, which fixes the issue. Vulnerabilidad de Server-Side Request Forgery (SSRF) en Apache HugeGraph-Hubble. Este problema afecta a Apache HugeGraph-Hubble: desde 1.0.0 antes de 1.3.0. Se recomienda a los usuarios actualizar a la versión 1.3.0, que soluciona el problema. • http://www.openwall.com/lists/oss-security/2024/04/22/2 https://lists.apache.org/thread/z0v71148slfkw60hsp35pl7ddjyvg01l • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 2.7EPSS: 0%CPEs: 1EXPL: 0CVE-2024-29733 – Apache Airflow FTP Provider: FTP_TLS instance with unverified SSL context
https://notcve.org/view.php?id=CVE-2024-29733
Improper Certificate Validation vulnerability in Apache Airflow FTP Provider. The FTP hook lacks complete certificate validation in FTP_TLS connections, which can potentially be leveraged. Implementing proper certificate validation by passing context=ssl.create_default_context() during FTP_TLS instantiation is used as mitigation to validate the certificates properly. This issue affects Apache Airflow FTP Provider: before 3.7.0. Users are recommended to upgrade to version 3.7.0, which fixes the issue. Vulnerabilidad de validación de certificado incorrecta en el proveedor FTP Apache Airflow. El enlace FTP carece de una validación completa del certificado en las conexiones FTP_TLS, lo que potencialmente puede aprovecharse. La implementación de una validación de certificados adecuada pasando context=ssl.create_default_context() durante la creación de instancias de FTP_TLS se utiliza como mitigación para validar los certificados correctamente. • http://www.openwall.com/lists/oss-security/2024/04/19/3 https://docs.python.org/3/library/ssl.html#best-defaults https://github.com/apache/airflow/blob/95e26118b828c364755f3a8c96870f3591b01c31/airflow/providers/ftp/hooks/ftp.py#L280 https://github.com/apache/airflow/pull/38266 https://lists.apache.org/thread/265t5zbmtjs6h9fkw52wtp03nsbplky2 • CWE-295: Improper Certificate Validation •