{"id":"CVE-2022-38370","aliases":["EUVD-2022-0024","GHSA-c86f-9grv-pmqf","PYSEC-2022-43070"],"status":"published","title":"No authorization of DatabaseConnectController in grafana-connector.","description":"Apache IoTDB grafana-connector version 0.13.0 contains an interface without authorization, which may expose the internal structure of database. Users should upgrade to version 0.13.1 which addresses this issue.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.01379,"percentile":0.72324,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-862"],"published":"2022-09-05T09:50:10Z","modified":"2026-10-28T02:30:36Z","fixes":[{"ecosystem":"Maven","package":"org.apache.iotdb:iotdb-grafana-connector","fixed_in":["0.13.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.iotdb:iotdb-grafana-connector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.13.1"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.apache.iotdb:iotdb-grafana-connector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.13.1"}]}],"versions":["0.13.0"]}],"products":[{"vendor":"apache","product":"iotdb"},{"vendor":"apache software foundation","product":"apache iotdb"}],"references":[{"url":"https://lists.apache.org/thread/kcpqgstvgf8sxy9ktxm1836nlwc8xy3j","tags":["x_refsource_MISC","x_transferred","Mailing List","Vendor Advisory","web","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2022/09/05/2","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","article","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-38370","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/apache-iotdb/PYSEC-2022-43070.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-c86f-9grv-pmqf"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/38xxx/CVE-2022-38370.json","tags":["advisory"]},{"url":"https://github.com/apache/iotdb","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2022-38370","title":"No authorization of DatabaseConnectController in grafana-connector. ","description":"Apache IoTDB grafana-connector version 0.13.0 contains an interface without authorization, which may expose the internal structure of database. Users should upgrade to version 0.13.1 which addresses this issue.","status":"published","published":"2022-09-05T09:50:10Z","modified":"2024-08-03T10:54:03.893Z","updated_at":"2026-11-02T14:34:37.272373Z"}],"euvd":[{"id":"EUVD-2022-0024","description":"Apache IoTDB grafana-connector version 0.13.0 contains an interface without authorization, which may expose the internal structure of database. Users should upgrade to version 0.13.1 which addresses this issue.","status":"published","published":"2022-09-05T09:50:10Z","modified":"2024-08-03T10:54:03Z","cvss":[{"version":"","score":0,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"none"}],"updated_at":"2026-11-03T03:25:22.392967Z"}],"ghsa":[{"id":"GHSA-c86f-9grv-pmqf","title":"Apache IoTDB grafana-connector contains an interface without authorization","description":"Apache IoTDB grafana-connector version 0.13.0 contains an interface without authorization, which may expose the internal structure of a database. Users should upgrade to version 0.13.1, which addresses this issue.","status":"published","published":"2022-09-06T00:00:27Z","modified":"2024-11-21T21:06:06Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:38:21.777721Z"}],"nvd":[{"id":"CVE-2022-38370","description":"Apache IoTDB grafana-connector version 0.13.0 contains an interface without authorization, which may expose the internal structure of database. Users should upgrade to version 0.13.1 which addresses this issue.","status":"published","published":"2022-09-05T10:15:09.633Z","modified":"2026-06-17T04:56:28.713Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:07:26.802986Z"}],"osv":[{"id":"GHSA-c86f-9grv-pmqf","title":"Apache IoTDB grafana-connector contains an interface without authorization","description":"Apache IoTDB grafana-connector version 0.13.0 contains an interface without authorization, which may expose the internal structure of a database. Users should upgrade to version 0.13.1, which addresses this issue.","status":"published","published":"2022-09-06T00:00:27Z","modified":"2024-11-22T05:12:35.546024Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:46:44.927642Z"},{"id":"PYSEC-2022-43070","description":"Apache IoTDB grafana-connector version 0.13.0 contains an interface without authorization, which may expose the internal structure of database. Users should upgrade to version 0.13.1 which addresses this issue.","status":"withdrawn","published":"2022-09-05T10:15:00Z","modified":"2025-10-09T08:25:24.242617Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:53.449407Z"},{"id":"CVE-2022-38370","title":"No authorization of DatabaseConnectController in grafana-connector. ","description":"Apache IoTDB grafana-connector version 0.13.0 contains an interface without authorization, which may expose the internal structure of database. Users should upgrade to version 0.13.1 which addresses this issue.","status":"published","published":"2022-09-05T09:50:10Z","modified":"2026-10-28T02:30:36.523238081Z","updated_at":"2026-11-02T15:44:26.53798Z"}]}}