Apache HugeGraph 漏洞列表

Apache HugeGraph-Server 存在 RCE（远程命令执行）漏洞。此问题影响 Apache HugeGraph-Server：Java8 和Java11 版本中 1.0.0 至 1.3.0 之前的版本。建议用户升级到 Java11 的 1.3.0 版本并启用身份验证系统

Apache HugeGraph-Server is an open-source graph database that provides a scalable and high-performance solution for managing and analyzing large-scale graph data. It is commonly used in Java8 and Java11 environments. However, versions prior to 1.3.0 are vulnerable to a remote command execution (RCE) vulnerability in the gremlin component.

Apache HugeGraph-Server versions prior to 1.5.0 contain an authentication bypass vulnerability caused by assumed-immutable data. This flaw allows attackers to bypass authentication mechanisms without requiring specific privileges or user interaction.

Apache HugeGraph-Server存在远程代码执行漏洞，此漏洞是程序对用户输入 gremlin 接口的数据缺乏校验导致的。

Apache HugeGraph-Server 存在服务器请求伪造漏洞，此漏洞是由于程序未充分验证用户输入的url是否为恶意网址所导致的。