org.apache.iotdb:node-commons 2.0.8

Direct Vulnerabilities

Known vulnerabilities in the org.apache.iotdb:node-commons package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
H Improper Privilege Management Affected versions of this package are vulnerable to Improper Privilege Management in its user rename handling, which reserves the `__internal_auditor` username as a privileged internal account but does not prevent an ordinary user from renaming their own account to that name. A user with an authenticated account can obtain full tree-path access by renaming themselves to `__internal_auditor`. This requires an authenticated account able to rename its own user on an affected 2.0.8 or 2.0.9 deployment. How to fix Improper Privilege Management? Upgrade `org.apache.iotdb:node-commons` to version 2.0.10 or higher.	[2.0.8,2.0.10)
H Directory Traversal Affected versions of this package are vulnerable to Directory Traversal in the `updateWritingFileIfNeeded()` method of `IoTDBFileReceiver`, which builds the write target as `new File(receiverFileDirWithIdSuffix.get(), fileName)` from the incoming pipe transfer `fileName` without confining it to the receiver directory. An attacker can write arbitrary files anywhere the IoTDB process has write permission by sending a pipe file transfer whose `fileName` contains `..` sequences that escape the intended receiver directory. Exploitation requires the ability to send to the pipe file receiver, and the writes are bounded by the file system permissions of the IoTDB process. How to fix Directory Traversal? Upgrade `org.apache.iotdb:node-commons` to version 2.0.10 or higher.	[1.0.0,2.0.10)

Vulnerability

Vulnerable Version

Improper Privilege Management

Affected versions of this package are vulnerable to Improper Privilege Management in its user rename handling, which reserves the __internal_auditor username as a privileged internal account but does not prevent an ordinary user from renaming their own account to that name. A user with an authenticated account can obtain full tree-path access by renaming themselves to __internal_auditor. This requires an authenticated account able to rename its own user on an affected 2.0.8 or 2.0.9 deployment.

How to fix Improper Privilege Management?

Upgrade org.apache.iotdb:node-commons to version 2.0.10 or higher.

[2.0.8,2.0.10)

Directory Traversal

Affected versions of this package are vulnerable to Directory Traversal in the updateWritingFileIfNeeded() method of IoTDBFileReceiver, which builds the write target as new File(receiverFileDirWithIdSuffix.get(), fileName) from the incoming pipe transfer fileName without confining it to the receiver directory. An attacker can write arbitrary files anywhere the IoTDB process has write permission by sending a pipe file transfer whose fileName contains .. sequences that escape the intended receiver directory. Exploitation requires the ability to send to the pipe file receiver, and the writes are bounded by the file system permissions of the IoTDB process.

How to fix Directory Traversal?

Upgrade org.apache.iotdb:node-commons to version 2.0.10 or higher.

[1.0.0,2.0.10)

org.apache.iotdb:node-commons@2.0.8

latest version

latest non vulnerable version

first published

latest version published

licenses detected

package registry

Direct Vulnerabilities

Fix vulnerabilities automatically