CVE-2025-48392 - Vulnerability Details - OpenCVE

A vulnerability in Apache IoTDB. This issue affects Apache IoTDB: from 1.3.3 through 1.3.4, from 2.0.1-beta through 2.0.4. Users are recommended to upgrade to version 2.0.5, which fixes the issue.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Apache	Iotdb

Configuration 1 [-]

OR	cpe:2.3:a:apache:iotdb::::::::
	cpe:2.3:a:apache:iotdb::::::::

No data.

References

Link	Providers
https://lists.apache.org/thread/1rn0637hptglmctf8cqd9425bj4q21td

History

Thu, 25 Sep 2025 16:15:00 +0000

Type	Values Removed	Values Added
CPEs		cpe:2.3:a:apache:iotdb::::::::

Thu, 25 Sep 2025 08:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Apache Apache iotdb
Vendors & Products		Apache Apache iotdb

Wed, 24 Sep 2025 19:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-400
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Wed, 24 Sep 2025 08:15:00 +0000

Type	Values Removed	Values Added
Description		A vulnerability in Apache IoTDB. This issue affects Apache IoTDB: from 1.3.3 through 1.3.4, from 2.0.1-beta through 2.0.4. Users are recommended to upgrade to version 2.0.5, which fixes the issue.
Title		Apache IoTDB: DoS Vulnerability
References		https://lists.apache.org/thread/1rn0637hptglmctf8cqd9425bj4q21td

MITRE

Status: PUBLISHED

Assigner: apache

Published: 2025-09-24T07:59:52.592Z

Updated: 2025-09-24T18:47:35.053Z

Reserved: 2025-05-20T01:52:06.367Z

Link: CVE-2025-48392

Vulnrichment

Updated: 2025-09-24T18:47:30.861Z

NVD

Status : Analyzed

Published: 2025-09-24T08:15:31.880

Modified: 2025-09-25T16:06:46.433

Link: CVE-2025-48392

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-48392", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2025-05-20T01:52:06.367Z", "datePublished": "2025-09-24T07:59:52.592Z", "dateUpdated": "2025-09-24T18:47:35.053Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Apache IoTDB", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "1.3.4", "status": "affected", "version": "1.3.3", "versionType": "semver"}, {"lessThanOrEqual": "2.0.4", "status": "affected", "version": "2.0.1-beta", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "yyjLF"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>A vulnerability in Apache IoTDB.</p><p>This issue affects Apache IoTDB: from 1.3.3 through 1.3.4, from 2.0.1-beta through 2.0.4.</p><p>Users are recommended to upgrade to version 2.0.5, which fixes the issue.</p>"}], "value": "A vulnerability in Apache IoTDB.\n\nThis issue affects Apache IoTDB: from 1.3.3 through 1.3.4, from 2.0.1-beta through 2.0.4.\n\nUsers are recommended to upgrade to version 2.0.5, which fixes the issue."}], "metrics": [{"other": {"content": {"text": "moderate"}, "type": "Textual description of severity"}}], "problemTypes": [{"descriptions": [{"description": "DoS Vulnerability", "lang": "en"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2025-09-24T07:59:52.592Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://lists.apache.org/thread/1rn0637hptglmctf8cqd9425bj4q21td"}], "source": {"discovery": "UNKNOWN"}, "title": "Apache IoTDB: DoS Vulnerability", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-400", "lang": "en", "description": "CWE-400 Uncontrolled Resource Consumption"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-09-24T18:47:15.364131Z", "id": "CVE-2025-48392", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-24T18:47:35.053Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-48392", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-24T18:47:15.364131Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-400", "description": "CWE-400 Uncontrolled Resource Consumption"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-24T18:47:30.861Z"}}], "cna": {"title": "Apache IoTDB: DoS Vulnerability", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "yyjLF"}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "moderate"}}}], "affected": [{"vendor": "Apache Software Foundation", "product": "Apache IoTDB", "versions": [{"status": "affected", "version": "1.3.3", "versionType": "semver", "lessThanOrEqual": "1.3.4"}, {"status": "affected", "version": "2.0.1-beta", "versionType": "semver", "lessThanOrEqual": "2.0.4"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://lists.apache.org/thread/1rn0637hptglmctf8cqd9425bj4q21td", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "A vulnerability in Apache IoTDB.\n\nThis issue affects Apache IoTDB: from 1.3.3 through 1.3.4, from 2.0.1-beta through 2.0.4.\n\nUsers are recommended to upgrade to version 2.0.5, which fixes the issue.", "supportingMedia": [{"type": "text/html", "value": "<p>A vulnerability in Apache IoTDB.</p><p>This issue affects Apache IoTDB: from 1.3.3 through 1.3.4, from 2.0.1-beta through 2.0.4.</p><p>Users are recommended to upgrade to version 2.0.5, which fixes the issue.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "DoS Vulnerability"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2025-09-24T07:59:52.592Z"}}}, "cveMetadata": {"cveId": "CVE-2025-48392", "state": "PUBLISHED", "dateUpdated": "2025-09-24T18:47:35.053Z", "dateReserved": "2025-05-20T01:52:06.367Z", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "datePublished": "2025-09-24T07:59:52.592Z", "assignerShortName": "apache"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apache:iotdb:*:*:*:*:*:*:*:*", "matchCriteriaId": "558A2438-67DF-456C-85A0-B27FA320FF5A", "versionEndIncluding": "1.3.4", "versionStartIncluding": "1.3.3", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:iotdb:*:*:*:*:*:*:*:*", "matchCriteriaId": "4442C12E-5351-4471-9FC6-0C61643EBE29", "versionEndExcluding": "2.0.5", "versionStartIncluding": "2.0.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability in Apache IoTDB.\n\nThis issue affects Apache IoTDB: from 1.3.3 through 1.3.4, from 2.0.1-beta through 2.0.4.\n\nUsers are recommended to upgrade to version 2.0.5, which fixes the issue."}], "id": "CVE-2025-48392", "lastModified": "2025-09-25T16:06:46.433", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2025-09-24T08:15:31.880", "references": [{"source": "security@apache.org", "tags": ["Vendor Advisory"], "url": "https://lists.apache.org/thread/1rn0637hptglmctf8cqd9425bj4q21td"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-400"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}