Unrated

Incorrect Authorization vulnerability in Apache Software Foundation Apache IoTDB.This issue affects the iotdb-web-workbench component from 0.13.0 before 0.13.3. iotdb-web-workbench is an optional comp

Disclosed: 31.01.2023
Updated: 11.10.2026 11:19

Incorrect Authorization vulnerability in Apache Software Foundation Apache IoTDB.This issue affects the iotdb-web-workbench component from 0.13.0 before 0.13.3. iotdb-web-workbench is an optional component of IoTDB, providing a web console of the database. This problem is fixed from version 0.13.3 of iotdb-web-workbench onwards.

Affected software

Click a technology to see all vulnerabilities affecting it.

Platform	Package	Vulnerable versions	Fixed in
Python (PyPI)	apache-iotdb	>= 0.13.0, < 0.13.3	0.13.3

References

https://lists.apache.org/thread/l0b59hh046tyn4gqot0bdrpg8gxlksmo

CVSS score -

Weakness (CWE): -
Platform: Python (PyPI)
Package: apache-iotdb
Disclosed: 31.01.2023
Updated: 11.10.2026 11:19

Sources and licenses

OSV / GitHub Advisory Database - PYSEC-2023-5 - PyPA Advisory Database; CC BY 4.0

Vulnerability history: apache-iotdb

All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (12) in the archive

Total entries: 12
First → latest: 09.2022 07.2026
Without a fix: 1
Exploited in attacks: 0

Severity breakdown

Critical 5
High 3
Medium 2
Unrated 2

Disclosures per year

2022: 2
2023: 3
2024: 1
2025: 3
2026: 3

06.07.2026

Uncontrolled Resource Consumption vulnerability in Apache IoTDB.

High · 7.5 CVE-2026-24012 >= 1.3.3, < 2.0.8 2.0.8
06.07.2026

Apache IoTDB DataNode’s internal RPC interface for creating Trigger instances uses the uploaded Trigger JAR name to build a file path without sufficient validation. If the internal DataNode RPC port i

Critical · 9.8 CVE-2026-24014 >= 1.3.3, < 2.0.8 2.0.8
06.07.2026

Authentication Bypass by Spoofing vulnerability in Apache IoTDB.

Critical · 9.1 CVE-2026-24013 >= 1.3.3, < 2.0.8 2.0.8
14.05.2025

Remote Code Execution with untrusted URI of UDF vulnerability in Apache IoTDB. The attacker who has privilege to create UDF can register malicious function from untrusted URI.

Critical · 9.8 CVE-2024-24780 >= 1.0.0, < 1.3.4 1.3.4
15.01.2024

Remote Code Execution vulnerability in Apache IoTDB.This issue affects Apache IoTDB: from 1.0.0 through 1.2.2.

Critical · 9.8 CVE-2023-46226 >= 1.0.0, < 1.3.0 1.3.0
17.04.2023

Improper Authentication vulnerability in Apache Software Foundation Apache IoTDB.This issue affects Apache IoTDB Grafana Connector: from 0.13.0 through 0.13.3.

Critical · 9.8 CVE-2023-24831 >= 0.13.0, < 0.13.5 0.13.5
31.01.2023

Incorrect Authorization vulnerability in Apache Software Foundation Apache IoTDB.This issue affects the iotdb-web-workbench component from 0.13.0 before 0.13.3. iotdb-web-workbench is an optional comp this entry

Unrated CVE-2023-24829 >= 0.13.0, < 0.13.3 0.13.3
26.10.2022

Apache IoTDB version 0.12.2 to 0.12.6, 0.13.0 to 0.13.2 are vulnerable to a Denial of Service attack when accepting untrusted patterns for REGEXP queries with Java 8. Users should upgrade to 0.13.3 wh

High · 7.5 CVE-2022-43766 >= 0.12.2, < 0.13.3 0.13.3
05.09.2022

Apache IoTDB version 0.13.0 is vulnerable by session id attack. Users should upgrade to version 0.13.1 which addresses this issue.

High · 8.8 CVE-2022-38369 < 0.13.1 0.13.1

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application