Every CVE Search/ Get API key

CVE-2024-27348

Apache HugeGraph-Server: Command execution in gremlin

9.8 CriticalIn KEVPublic exploitFix available

RCE-Remote Command Execution vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0 in Java8 & Java11

Users are recommended to upgrade to version 1.3.0 with Java11 & enable the Auth system, which fixes the issue.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

99.2%Up 99.2 points since Apr 23, 2024
90%50%10%1%

What each source reports

NVD Score used 9.8

RCE-Remote Command Execution vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0 in Java8 & Java11

Users are recommended to upgrade to version 1.3.0 with Java11 & enable the Auth system, which fixes the issue.

Record
CVE-2024-27348
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-284
Updated
2026-11-02
CVE List 9.8

Apache HugeGraph-Server: Command execution in gremlin

RCE-Remote Command Execution vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0 in Java8 & Java11

Users are recommended to upgrade to version 1.3.0 with Java11 & enable the Auth system, which fixes the issue.

Record
CVE-2024-27348
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-284
Updated
2026-11-02
EUVDEUVD-2024-1059 9.8

RCE-Remote Command Execution vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0 in Java8 & Java11

Users are recommended to upgrade to version 1.3.0 with Java11 & enable the Auth system, which fixes the issue.

Record
EUVD-2024-1059
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-29rc-vq7f-x335 9.3

Apache HugeGraph-Server: Command execution in gremlin

RCE-Remote Command Execution vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0 in Java8 & Java11

Users are recommended to upgrade to version 1.3.0 with Java11 & enable the Auth system, which fixes the issue.

Record
GHSA-29rc-vq7f-x335
CVSS 4.0
9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
Weakness
CWE-77, CWE-284
Updated
2026-11-02
CISA KEV No score

Apache HugeGraph-Server Improper Access Control Vulnerability

Apache HugeGraph-Server contains an improper access control vulnerability that could allow a remote attacker to execute arbitrary code.

Record
CVE-2024-27348
Weakness
CWE-284
Updated
2026-11-02
OSV 9.8

Apache HugeGraph-Server: Command execution in gremlin

RCE-Remote Command Execution vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0 in Java8 & Java11

Users are recommended to upgrade to version 1.3.0 with Java11 & enable the Auth system, which fixes the issue.

Record
CVE-2024-27348
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVGHSA-29rc-vq7f-x335 9.3

Apache HugeGraph-Server: Command execution in gremlin

RCE-Remote Command Execution vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0 in Java8 & Java11

Users are recommended to upgrade to version 1.3.0 with Java11 & enable the Auth system, which fixes the issue.

Record
GHSA-29rc-vq7f-x335
CVSS 4.0
9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
Weakness
CWE-284, CWE-77
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.apache.hugegraph:hugegraph-api
Maven
 1.0.0 up to 1.3.0
1.3.0
org.apache.hugegraph:hugegraph-core
Maven
 1.0.0 up to 1.3.0
1.3.0
org.apache.hugegraph:hugegraph-api
Maven
 1.0.0 up to 1.3.0, plus listed versions
1.2.0
1.3.0
org.apache.hugegraph:hugegraph-core
Maven
 1.0.0 up to 1.3.0, plus listed versions
1.2.0
1.3.0

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
MetasploitApache HugeGraph Gremlin RCE2024-04-22
PoC in GitHubZeyad-Azima/CVE-2024-273482024-05-31
PoC in GitHubkljunowsky/CVE-2024-273482024-06-03
PoC in GitHubjakabakos/CVE-2024-27348-Apache-HugeGraph-RCE2024-06-12
PoC in GitHubp0et08/CVE-2024-273482025-02-10
Exploit-DBApache HugeGraph Server 1.2.0 - Remote Code Execution (RCE)2025-04-09
PoC in GitHubwqfh/CVE-2024-273482025-12-13
PoC in GitHubakelaqe/CVE-2024-27348-HugeGraph-RCE2026-03-30
NucleiApache HugeGraph-Server - Remote Command Execution

History

History
RecordedChangedSources
exploitation, exploits
first indexedCVE List, EUVD, Exploit-DB, GitHub Advisories, CISA KEV, Metasploit, Nuclei, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-27348 is a critical vulnerability (CVSS 9.8) in Apache Hugegraph, published April 22, 2024. CISA lists it as known to be exploited, since September 18, 2024. EUVD reports exploitation since September 18, 2024. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 99.2%, the 99th percentile. Fixed in org.apache.hugegraph:hugegraph-api 1.3.0.

References

Show 4 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open