CVE-2024-27438

CRITICAL Year: 2024
CVSS v3 Score
9.8
Critical
Weakness Type
CWE-494
View all →

Vulnerability Description

Download of Code Without Integrity Check vulnerability in Apache Doris. The jdbc driver files used for JDBC catalog is not checked and may resulting in remote command execution. Once the attacker is authorized to create a JDBC catalog, he/she can use arbitrary driver jar file with unchecked code snippet. This code snippet will be run when catalog is initializing without any check. This issue affects Apache Doris: from 1.2.0 through 2.0.4. Users are recommended to upgrade to version 2.0.5 or 2.1.x, which fixes the issue.

Related Vulnerabilities

CVE-2001-1125

CRITICAL
CVSS:9.8(Critical)

Symantec LiveUpdate before 1.6 does not use cryptography to ensure the integrity of download files, which allows remote attackers to execute arbitrary code via DNS spoofing of the update.symantec.com ...

CWE-4942001

CVE-2002-0671

CRITICAL
CVSS:9.8(Critical)

Pingtel xpressa SIP-based voice-over-IP phone 1.2.5 through 1.2.7.4 downloads phone applications from a web site but can not verify the integrity of the applications, which could allow remote attacker...

CWE-4942002

CVE-2016-6567

CRITICAL
CVSS:9.8(Critical)

SHDesigns' Resident Download Manager provides firmware update capabilities for Rabbit 2000/3000 CPU boards, which according to the reporter may be used in some industrial control and embedded applicat...

CWE-4942016

CVE-2018-14620

CRITICAL
CVSS:9.8(Critical)

The OpenStack RabbitMQ container image insecurely retrieves the rabbitmq_clusterer component over HTTP during the build stage. This could potentially allow an attacker to serve malicious code to the i...

CWE-4942018

CVE-2018-5409

CRITICAL
CVSS:9.8(Critical)

The PrinterLogic Print Management software, versions up to and including 18.3.1.96, updates and executes the code without sufficiently verifying the origin and integrity of the code. An attacker can e...

CWE-4942018

CVE-2019-19167

CRITICAL
CVSS:9.8(Critical)

Tobesoft Nexacro v2019.9.25.1 and earlier version have an arbitrary code execution vulnerability by using method supported by Nexacro14 ActiveX Control. It allows attacker to cause remote code executi...

CWE-4942019