Login check vulnerability by session Id

published 2022-09-05 4 y ago modified 2026-07-01 4 mo ago also GHSA-g6vm-3ch8-c6jq , PYSEC-2022-43069 , EUVD-2022-0023

cvss: 8.8; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 1.3%; EPSS 1.3% chance of exploitation in 30 days, percentile 70%
public exploits: 0; none known

Apache IoTDB version 0.13.0 is vulnerable by session id attack. Users should upgrade to version 0.13.1 which addresses this issue.

Patch / fix

fixed in 2

maven org.apache.iotdb:iotdb-server 0.13.1
pypi apache-iotdb 0.13.1

Exploit prediction

1.30% chance of exploitation in the next 30 days, higher than 70% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
NVD	3.1	8.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
OSV	3.1	8.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
GitHub	3.1	8.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected packages

ecosystem	package	affected	fixed in
maven	org.apache.iotdb:iotdb-server	<0.13.1	0.13.1
pypi	apache-iotdb	<0.13.1	0.13.1

Affected products

Apache Software Foundation Apache IoTDB

Classification

Weakness

CWE-384 Session Fixation

References

lists.apache.org /thread/7nk03ywvx3t3yjbcxzt7zy4nyc89y9b0
web, mailing-list, vendor-advisory, article, advisory
openwall.com /lists/oss-security/2022/09/05/1
mailing-list, web, third-party-advisory, article
nvd.nist.gov /vuln/detail/CVE-2022-38369
advisory
github.com /apache/iotdb
package
github.com /pypa/advisory-database/tree/main/vulns/apache-iotdb/PYSEC-2022-43069.yaml
web
github.com /advisories/GHSA-g6vm-3ch8-c6jq
advisory

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary