{"id":"CVE-2024-27348","aliases":["EUVD-2024-1059","GHSA-29rc-vq7f-x335"],"status":"published","title":"Apache HugeGraph-Server: Command execution in gremlin","description":"RCE-Remote Command Execution vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0 in Java8 \u0026 Java11\n\nUsers are recommended to upgrade to version 1.3.0 with Java11 \u0026 enable the Auth system, which fixes the issue.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.9921,"percentile":0.99935,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":true},"cwes":["CWE-284","CWE-77"],"published":"2024-04-22T14:08:06Z","modified":"2026-10-28T10:36:35Z","kev":{"date_added":"2024-09-18","due_date":"2024-10-09","required_action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2024-09-18"},{"source":"kev","since":"2024-09-18"}],"exploits":[{"source":"metasploit","id":"exploit/linux/http/apache_hugegraph_gremlin_rce","title":"Apache HugeGraph Gremlin RCE","type":"exploit","platform":"Linux,Unix","date":"2024-04-22","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/linux/http/apache_hugegraph_gremlin_rce"},{"source":"pocgithub","id":"Zeyad-Azima/CVE-2024-27348","title":"Zeyad-Azima/CVE-2024-27348","date":"2024-05-31","url":"https://github.com/Zeyad-Azima/CVE-2024-27348"},{"source":"pocgithub","id":"kljunowsky/CVE-2024-27348","title":"kljunowsky/CVE-2024-27348","date":"2024-06-03","url":"https://github.com/kljunowsky/CVE-2024-27348"},{"source":"pocgithub","id":"jakabakos/CVE-2024-27348-Apache-HugeGraph-RCE","title":"jakabakos/CVE-2024-27348-Apache-HugeGraph-RCE","date":"2024-06-12","url":"https://github.com/jakabakos/CVE-2024-27348-Apache-HugeGraph-RCE"},{"source":"pocgithub","id":"p0et08/CVE-2024-27348","title":"p0et08/CVE-2024-27348","date":"2025-02-10","url":"https://github.com/p0et08/CVE-2024-27348"},{"source":"exploitdb","id":"EDB-52149","title":"Apache HugeGraph Server 1.2.0 - Remote Code Execution (RCE)","type":"webapps","platform":"java","date":"2025-04-09","url":"https://www.exploit-db.com/exploits/52149"},{"source":"pocgithub","id":"wqfh/CVE-2024-27348","title":"wqfh/CVE-2024-27348","date":"2025-12-13","url":"https://github.com/wqfh/CVE-2024-27348"},{"source":"pocgithub","id":"akelaqe/CVE-2024-27348-HugeGraph-RCE","title":"akelaqe/CVE-2024-27348-HugeGraph-RCE","date":"2026-03-30","url":"https://github.com/akelaqe/CVE-2024-27348-HugeGraph-RCE"},{"source":"nuclei","id":"CVE-2024-27348","title":"Apache HugeGraph-Server - Remote Command Execution","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-27348.yaml"}],"fixes":[{"ecosystem":"Maven","package":"org.apache.hugegraph:hugegraph-api","fixed_in":["1.3.0"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.apache.hugegraph:hugegraph-core","fixed_in":["1.3.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.hugegraph:hugegraph-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.3.0"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.hugegraph:hugegraph-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.3.0"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.apache.hugegraph:hugegraph-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.3.0"}]}],"versions":["1.0.0","1.2.0"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.hugegraph:hugegraph-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.3.0"}]}],"versions":["1.0.0","1.2.0"]}],"products":[{"vendor":"apache","product":"hugegraph"},{"vendor":"apache","product":"hugegraph-server"},{"vendor":"apache software foundation","product":"apache hugegraph-server"}],"references":[{"url":"https://hugegraph.apache.org/docs/config/config-authentication/#configure-user-authentication","tags":["related","x_transferred","Product","web"]},{"url":"https://lists.apache.org/thread/nx6g6htyhpgtzsocybm242781o8w5kq9","tags":["vendor-advisory","x_transferred","Mailing List","Vendor Advisory","advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2024/04/22/3","tags":["x_transferred","Mailing List","Third Party Advisory","web"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-27348","tags":["government-resource","Third Party Advisory","US Government Resource","web"]},{"url":"https://www.vicarius.io/vsociety/posts/remote-code-execution-vulnerability-in-apache-hugegraph-server-cve-2024-27348","tags":["Exploit","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-27348","tags":["advisory"]},{"url":"https://github.com/apache/incubator-hugegraph/commit/713d88d1fd9953c3c3e3f130389501910ba40e1d","tags":["web"]},{"url":"https://github.com/advisories/GHSA-29rc-vq7f-x335"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/27xxx/CVE-2024-27348.json","tags":["advisory"]},{"url":"https://github.com/apache/incubator-hugegraph","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-27348","title":"Apache HugeGraph-Server: Command execution in gremlin","description":"RCE-Remote Command Execution vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0 in Java8 \u0026 Java11\n\nUsers are recommended to upgrade to version 1.3.0 with Java11 \u0026 enable the Auth system, which fixes the issue.","status":"published","published":"2024-04-22T14:08:06.294Z","modified":"2025-10-21T23:05:21.096Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:34:12.635756Z"}],"euvd":[{"id":"EUVD-2024-1059","description":"RCE-Remote Command Execution vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0 in Java8 \u0026 Java11\n\nUsers are recommended to upgrade to version 1.3.0 with Java11 \u0026 enable the Auth system, which fixes the issue.","status":"published","published":"2024-04-22T14:08:06Z","modified":"2025-10-21T23:05:21Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"exploited_since":"2024-09-18","updated_at":"2026-11-02T20:31:28.525814Z"}],"ghsa":[{"id":"GHSA-29rc-vq7f-x335","title":"Apache HugeGraph-Server: Command execution in gremlin","description":"RCE-Remote Command Execution vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0 in Java8 \u0026 Java11\n\nUsers are recommended to upgrade to version 1.3.0 with Java11 \u0026 enable the Auth system, which fixes the issue.","status":"published","published":"2024-04-22T15:30:41Z","modified":"2025-10-22T19:25:20Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H","level":"critical"},{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A","level":"critical"}],"cwes":["CWE-77","CWE-284"],"updated_at":"2026-11-02T14:39:02.474737Z"}],"kev":[{"id":"CVE-2024-27348","title":"Apache HugeGraph-Server Improper Access Control Vulnerability","description":"Apache HugeGraph-Server contains an improper access control vulnerability that could allow a remote attacker to execute arbitrary code.","cwes":["CWE-284"],"kev":{"date_added":"2024-09-18","due_date":"2024-10-09","required_action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:16.234141Z"}],"nvd":[{"id":"CVE-2024-27348","description":"RCE-Remote Command Execution vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0 in Java8 \u0026 Java11\n\nUsers are recommended to upgrade to version 1.3.0 with Java11 \u0026 enable the Auth system, which fixes the issue.","status":"published","published":"2024-04-22T14:15:07.42Z","modified":"2026-06-17T07:19:42.14Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:09:53.50104Z"}],"osv":[{"id":"CVE-2024-27348","title":"Apache HugeGraph-Server: Command execution in gremlin","description":"RCE-Remote Command Execution vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0 in Java8 \u0026 Java11\n\nUsers are recommended to upgrade to version 1.3.0 with Java11 \u0026 enable the Auth system, which fixes the issue.","status":"published","published":"2024-04-22T14:08:06.294Z","modified":"2026-10-28T10:36:35.086786662Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:39.569658Z"},{"id":"GHSA-29rc-vq7f-x335","title":"Apache HugeGraph-Server: Command execution in gremlin","description":"RCE-Remote Command Execution vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0 in Java8 \u0026 Java11\n\nUsers are recommended to upgrade to version 1.3.0 with Java11 \u0026 enable the Auth system, which fixes the issue.","status":"published","published":"2024-04-22T15:30:41Z","modified":"2025-10-22T19:41:41.709068Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H","level":"critical"},{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A","level":"critical"}],"cwes":["CWE-284","CWE-77"],"updated_at":"2026-11-02T15:46:33.956911Z"}]}}