Critical severity · published Apr 27, 2020
CVE-2020-1952
An issue was found in Apache IoTDB .9.0 to 0.9.1 and 0.8.0 to 0.8.2
9.8
CVSS
2.7%
EPSS
No
On KEV
Description
An issue was found in Apache IoTDB .9.0 to 0.9.1 and 0.8.0 to 0.8.2. When starting IoTDB, the JMX port 31999 is exposed with no certification.Then, clients could execute code remotely.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.7% · higher than 86% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IO
Iotdb · Apache
0.8.0 through 0.8.2; 0.9.0 through 0.9.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-1952
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-1952
Vendor Advisory
https://lists.apache.org/thread.html/r3d2ff899ead64d2952fdc1fbb1f520ca42011ed2b4c7f786e921f6b9%40%3Cdev.iotdb.apache.org%3E
More from Iotdb
9.8
CVE-2026-24014
Apache IoTDB: Path Traversal in DataNode Internal RPC Trigger JAR Upload Allows Arbitrary File Write
9.8
CVE-2026-24713
Apache IoTDB: JEXL Expression Injection Vulnerability
9.8
CVE-2026-24015
Apache IoTDB: Insecure Default Configuration Vulnerability
9.8
CVE-2024-24780
Remote Code Execution with untrusted URI of UDF vulnerability in Apache IoTDB
9.8
CVE-2023-46226
Remote Code Execution vulnerability in Apache IoTDB.This issue affects Apache IoTDB: from 1.0.0 through 1.2.2