Apache IoTDB Improper Input Validation Vulnerability

A vulnerability allowing JEXL expression injection has been identified in Apache IoTDB. This issue arises from improper input validation and affects Apache IoTDB versions 1.0.0 prior to 1.3.7 and 2.0.0 prior to 2.0.7. Users are advised to upgrade to versions 1.3.7 or 2.0.7, which address this vulnerability.

Impact

Exploitation of this vulnerability allows for JEXL expression injection, which could lead to arbitrary code execution or manipulation of application logic, depending on the context in which the JEXL expressions are evaluated.

Remediation

Users should upgrade to Apache IoTDB version 1.3.7 or 2.0.7.