Critical Access Control Vulnerability in Apache HugeGraph-Server

What changed

An improper access control vulnerability has been discovered in Apache HugeGraph-Server, which could potentially allow for remote command execution (RCE). This vulnerability affects all versions from 1.0.0 up to, but not including, 1.3.0 when using Java 8 and Java 11.

Users are strongly advised to upgrade to version 1.3.0 and enable the authentication system to mitigate this risk.

Who is affected

The vulnerability impacts a range of users and organizations utilizing Apache HugeGraph-Server, particularly those running older versions of the software.

Specific groups that should be aware include:

• Organizations using Apache HugeGraph-Server versions from 1.0.0 to 1.2.9.
• Developers and system administrators managing Java 8 and Java 11 environments.
• Enterprises relying on HugeGraph for graph database solutions.
• Security teams tasked with maintaining application security within their infrastructure.

What to do

To address this vulnerability, immediate action is required. Users should upgrade to the latest version of Apache HugeGraph-Server, specifically version 1.3.0 or later.

Additionally, enabling the authentication system is crucial to ensure that access control mechanisms are properly enforced.

• Upgrade Apache HugeGraph-Server to version 1.3.0 or higher.
• Enable the authentication system to enhance security.
• Review and audit existing access controls to ensure compliance.
• Monitor for any unusual activity that may indicate exploitation attempts.