CVE-2023-46226

The vulnerability classified as CWE-94 (code injection) allows an attacker to inject and execute arbitrary code on a vulnerable Apache IoTDB server. The attack can be conducted remotely over the network without requiring an account or any user interaction. The detailed exploitation mechanism was not disclosed in the vendor's description.

Successful exploitation of the vulnerability gives the attacker full control over the system — data breach is possible, modification of the time series database, and potentially further lateral movement in the infrastructure.

Apache IoTDB should be updated to version 1.3.0 or newer as soon as possible, which eliminates the described vulnerability. The vendor explicitly recommends this version as a solution to the problem.

Apache IoTDB in versions 1.0.0 to 1.2.2 inclusive.