CVE-2024-27348Disclosure(apache / hugegraph)

LOWCVSS 9.8 · CRITICALCISA KEV

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Patch apache hugegraph systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

RCE-Remote Command Execution vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0 in Java8 & Java11 Users are recommended to upgrade to version 1.3.0 with Java11 & enable the Auth system, which fixes the issue.

apache CVEs Back to dashboard

2.0/ 10 priority

Sources & remediation

Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2024-10-09. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Exploit / PoC references

https://www.vicarius.io/vsociety/posts/remote-code-execution-vulnerability-in-apache-hugegraph-server-cve-2024-27348

Vendor / third-party advisories

Other references

Weakness type (CWE)

CWE-284

Priority

LOW

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

hugegraph

Threat summary

Public PoC is present in monitored signal
Patch or workaround signal is available
1 mentions across 1 observed day

What's happening

PoC mentioned or linked in 1 signal
Patch or workaround mentioned in 1 signal
Technical details provided in 1 signal
Disclosure: 1 classified signal
1 total mentions across 1 day

Affected systems

Vendors

apache

Products

hugegraph

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

Disclosure

1100.0%

Referenced assets1 URL

By indicator

https://www.youtube.com/watch?v=Hv8H7ZgNdi4

Full discourse1 post

r0otk3r@r0otk3r92d
Disclosure
🚨 CVE-2024-27348: Critical 9.8 CVSS Apache HugeGraph Unauthenticated RCE https://www.youtube.com/watch?v=Hv8H7ZgNdi4 #Cybersecurity #Infosec #AppSec #RCE #Apache #HugeGraph #Gremlin #SandboxBypass #CVE202427348 #PoC #EthicalHacking #BugBounty #PatchNow https://t.co/ObbVZ3iBwd
Post summary
The tweet declares the discovery of CVE‑2024‑27348, a critical unauthenticated RCE in Apache HugeGraph (CVSS 9.8), shares a YouTube link likely showing a PoC, and urges users to patch the vulnerability.
0001061
43 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	apache	hugegraph	-	-	-

Explore more

Back to dashboard apache CVEs hugegraph vulnerabilities