Critical Access Control Vulnerability Discovered in Apache HugeGraph-Server

What changed

A serious security flaw has been uncovered in Apache HugeGraph-Server, specifically an improper access control vulnerability that can lead to remote command execution (RCE). This vulnerability impacts versions from 1.0.0 up to, but not including, 1.3.0.

Users are strongly advised to upgrade to version 1.3.0, which includes necessary fixes and enhancements to the authentication system.

Who is affected

The vulnerability affects a range of users and organizations utilizing Apache HugeGraph-Server, particularly those running versions prior to 1.3.0.

The following groups are notably impacted:

• Organizations using Apache HugeGraph-Server for data management and analytics.
• Developers relying on Java8 and Java11 for their applications.
• Any entity that has not implemented the updated authentication measures in their HugeGraph-Server setup.

What to do

To mitigate the risk associated with this vulnerability, immediate action is required. Users should prioritize upgrading to the latest version of Apache HugeGraph-Server.

Additionally, enabling the authentication system is crucial to safeguard against potential exploitation.

• Upgrade to Apache HugeGraph-Server version 1.3.0 or later.
• Enable the authentication system to enhance security.
• Regularly monitor security advisories for updates and patches.