The US Cybersecurity and Infrastructure Agency (CISA) has added five vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, including a critical remote code execution flaw affecting Apache HugeGraph-Server. The CVE-2024-27348 vulnerability, rated 9.8, impacts versions from 1.0.0 to 1.3.0 and allows improper access control.
Apache fixed the vulnerability in April 2024 by releasing version 1.3.0. Users are advised to upgrade to the latest version or use Java 11 and enable the Auth system. Additionally, enabling the “Whitelist-IP/port” function can improve RESTful-API execution security.
CISA has warned that active exploitation of CVE-2024-27348 has been observed in the wild, giving federal agencies and critical infrastructure organizations until October 9, 2024, to apply mitigations or discontinue using Apache HugeGraph-Server. The product is used by telecom providers for fraud detection, financial services for risk control, and social networks for connection analysis.
As active exploitation continues and the product is used in high-value enterprise environments, applying available security updates and mitigations as soon as possible is essential.
Source: https://www.bleepingcomputer.com/news/security/cisa-warns-of-actively-exploited-apache-hugegraph-server-bug/