Description
An issue was found in Apache IoTDB .9.0 to 0.9.1 and 0.8.0 to 0.8.2. When starting IoTDB, the JMX port 31999 is exposed with no certification.Then, clients could execute code remotely.
Remediation
References
https://lists.apache.org/thread.html/r3d2ff899ead64d2952fdc1fbb1f520ca42011ed2b4c7f786e921f6b9%40%3Cdev.iotdb.apache.org%3E
Related Vulnerabilities
CVE-2020-2285 Vulnerability in maven package org.jenkins-ci.plugins:liquibase-runner
CVE-2016-7103 Vulnerability in maven package org.webjars.npm:jquery-ui
CVE-2018-1000665 Vulnerability in maven package org.webjars:dojo
CVE-2016-4970 Vulnerability in maven package io.netty:netty-handler
CVE-2023-50728 Vulnerability in npm package @octokit/webhooks