CVE-2026-28564

9.8 Critique

Publiée le 10/07/2026 à 10:16 · Modifiée le 10/07/2026 à 18:16 · Analyse NVD reportée · Source : security@apache.org

Description

Insufficient Session Expiration, Authentication Bypass by Capture-replay vulnerability in Apache IoTDB. REST Basic Authentication Accepts Stale Cached Credentials This issue affects Apache IoTDB: from 1.0.0 before 2.0.10. Users are recommended to upgrade to version 2.0.10, which fixes the issue.

Traduire en français

Produits concernés

Apache Software Foundation Apache IoTDB

Scores CVSS

Version	Score	Source	Vecteur
3.1	9.8 Critique	134c704f-9b21-4f2e-91b3-4a467353bcc0	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-294
CWE-613

Références

https://lists.apache.org/thread/l38wpy7flvvfwv4rkps87l5z8gprnfy0
http://www.openwall.com/lists/oss-security/2026/07/10/1

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories