{"id":"CVE-2020-1952","details":"An issue was found in Apache IoTDB .9.0 to 0.9.1 and 0.8.0 to 0.8.2. When starting IoTDB, the JMX port 31999 is exposed with no certification.Then, clients could execute code remotely.","aliases":["GHSA-wc6f-cjcp-cc33"],"modified":"2026-07-09T01:06:49.784759Z","published":"2020-04-27T17:15:13.533Z","references":[{"type":"ADVISORY","url":"https://lists.apache.org/thread.html/r3d2ff899ead64d2952fdc1fbb1f520ca42011ed2b4c7f786e921f6b9%40%3Cdev.iotdb.apache.org%3E"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/apache/iotdb","events":[{"introduced":"2f4da03b05d1c063eaaca622c68de86abe35de22"},{"last_affected":"09a94f2c02dec27f483a2ccb41a8265331be193d"},{"introduced":"257df94d57c29c628b1ab0d6a2fdd20ba7df9ca4"},{"last_affected":"d665690607933db9fdac057ebe250c19c9f63974"}],"database_specific":{"cpe":"cpe:2.3:a:apache:iotdb:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0.8.0"},{"last_affected":"0.8.2"},{"introduced":"0.9.0"},{"last_affected":"0.9.1"}],"source":"CPE_RANGE"}}],"versions":["release/0.9.1","release/0.8.2","release/0.9.0","release-0.8.1","release/0.8.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-1952.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}