CVE-2024-24780: 
Java vulnerability analysis and mitigation

A Remote Code Execution (RCE) vulnerability has been identified in Apache IoTDB, tracked as CVE-2024-24780. The vulnerability affects Apache IoTDB versions from 1.0.0 to versions before 1.3.4. The issue specifically involves untrusted URI handling in User-Defined Functions (UDF), where attackers with UDF creation privileges can register malicious functions from untrusted URIs (NVD, Wiz).

The vulnerability is classified as CWE-94 (Improper Control of Generation of Code - 'Code Injection'). According to the CVSS 3.1 scoring, it has received a critical base score of 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high severity with potential for complete compromise of system confidentiality, integrity, and availability (NVD).

The vulnerability allows attackers with UDF creation privileges to execute arbitrary code through malicious function registration from untrusted URIs. This could potentially lead to complete system compromise, affecting the confidentiality, integrity, and availability of the Apache IoTDB system (Wiz).

Users are strongly recommended to upgrade to Apache IoTDB version 1.3.4, which contains the fix for this vulnerability. This is currently the only confirmed mitigation strategy (NVD, Wiz).