Executive brief
Apache IoTDB version 0.13.0 is vulnerable by session id attack. Users should upgrade to version 0.13.1 which addresses this issue.
Affected products
- Maven org.apache.iotdb:iotdb-server
- PyPI apache-iotdb
Junglewise Threat Intelligence
CVE-2022-38369: PYSEC-2022-43069 - Apache IoTDB version 0.13.0 is vulnerable by session id attack. Users should upgrade to version 0.13.1 which addresses this issue.
CVE-2022-38369 · Severity: low · CVSS 3.1 · Published 2022-09-05
Technologies: apache-iotdb (PyPI). Vendors: Maven, PyPI.
Related threats
- Apache IoTDB path traversal in DataNode RPC interface
- Apache IoTDB authentication bypass in Thrift RPC query handlers
- Apache IoTDB uncontrolled resource consumption in query interface
- Apache IoTDB insecure deserialization in external input processing
- PYSEC-2025-60 - Exposure of Sensitive Information to an Unauthorized Actor, Insertion of Sensitive Information into Log File vulnerability in the OpenIdAuth