High · 8.8 CVE-2023-24829 EUVD-2023-0038GHSA-98mx-4vv7-3pq6PYSEC-2023-5

Apache IoTDB Workbench: apache/iotdb-web-workbench: forge the JWTToken to access workbench

Published Jan 31, 2023 · Updated Mar 27, 2025 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache IoTDB Workbench Package: apache-iotdb Ecosystem: PyPI

Description

Incorrect Authorization vulnerability in Apache Software Foundation Apache IoTDB.This issue affects the iotdb-web-workbench component from 0.13.0 before 0.13.3. iotdb-web-workbench is an optional component of IoTDB, providing a web console of the database.

This problem is fixed from version 0.13.3 of iotdb-web-workbench onwards.

Affected products

Vendor	Product	Affected	Fixed
Apache Software Foundation	Apache IoTDB Workbench	0.13.0 – < 0.13.3	0.13.3

Affected packages

Ecosystem	Package	Affected	Fixed	Record
PyPI	apache-iotdb	>= 0.13.0, < 0.13.3	0.13.3	PYSEC-2023-5

References

https://lists.apache.org/thread/l0b59hh046tyn4gqot0bdrpg8gxlksmo vendor-advisory