Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.3
CVE-2022-38369: Apache IoTDB allows login without proper session check
CVE-2022-38369 · published 4 years ago
Summary
The IoTDB server version 0.13.0 does not correctly verify a user’s session ID, which could let someone gain access without proper authentication. This can expose your data and control of the IoTDB service. Upgrade the server to version 0.13.1 as soon as possible to fix the issue.
What to do
- Update apache org.apache.iotdb:iotdb-server to version 0.13.1.
- Update apache iotdb apache-iotdb to version 0.13.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| maven | apache | org.apache.iotdb:iotdb-server |
< 0.13.1 Fix: upgrade to 0.13.1
|
| – | apache | iotdb |
0.13.0 cpe:2.3:a:apache:iotdb:0.13.0:*:*:*:*:*:*:* |
| pip | apache iotdb | apache-iotdb |
< 0.13.1 Fix: upgrade to 0.13.1
|
Original advisory text
Login check vulnerability by session Id
Apache IoTDB version 0.13.0 is vulnerable by session id attack. Users should upgrade to version 0.13.1 which addresses this issue.
References
- https://github.com/pypa/advisory-database/tree/main/vulns/apache-iotdb/PYSEC-202...
- https://github.com/advisories/GHSA-g6vm-3ch8-c6jq
- https://lists.apache.org/thread/7nk03ywvx3t3yjbcxzt7zy4nyc89y9b0 URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/38xxx/CVE-2022-38369... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2022-38369 Vendor Advisory
- http://www.openwall.com/lists/oss-security/2022/09/05/1 Third Party Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Type
CWE-384Session Fixation
Timeline
Published5 Sep 2022
Updated4 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta