CyberRota Analysis
AI-GeneratedApache IoTDB versions prior to 2.0.10 are vulnerable to a critical 'Unsafe Reflection' issue that allows attackers to exploit externally-controlled input to instantiate arbitrary Java classes, potentially leading to remote code execution. Organizations using affected versions should prioritize upgrading to 2.0.10 to mitigate the risk of exploitation. This vulnerability poses a significant threat to the security of systems utilizing Apache IoTDB, particularly in environments where untrusted input can be processed.
Original NVD Description
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache IoTDB. The pipe processor reads a fully qualified Java class name and instantiates it using Class.forName().newInstance() without any validation or allowlisting. This issue affects Apache IoTDB: from 1.0.0 before 2.0.10. Users are recommended to upgrade to version 2.0.10, which fixes the issue.