CVE-2024-24780

Remote Code Execution with untrusted URI of UDF vulnerability in Apache IoTDB. The attacker who has privilege to create UDF can register malicious function from untrusted URI. This issue affects Apache IoTDB: from 1.0.0 before 1.3.4. Users are recommended to upgrade to version 1.3.4, which fixes the issue.

Score

CVSS 3.1 9.8 Critical

Status

Analyzed - security@apache.org

Published

2025-05-14

Last modified

2026-02-26

Weaknesses

CWE-94

Affected products

• Iotdb (Apache)
• Apache Iotdb (Apache Software Foundation)

References

• https://lists.apache.org/thread/xphtm98v3zsk9vlpfh481m1ry2ctxvmj
• http://www.openwall.com/lists/oss-security/2025/05/14/2