Threats tagged 'ghsa-6m49-362q-wcpg'

Apache IoTDB versions from 2.0.0 up to but not including 2.0.11 contain a vulnerability in the Legacy Pipe receiver protocol. The protocol uses a hardcoded SUPER_USER (root) identity for certain data loading and deletion operations. This allows a user with SYSTEM-level privileges but without WRITE_DATA or DELETE_DATA permissions to bypass the permission model and perform these operations as root. The issue is fixed in version 2.0.11.