PUBLISHED
2026-07-10 08:16
MODIFIED
2026-07-10 08:16
EPSS (Prob. Exploit)
0.60%
Top 52.0%
> DESCRIPTION
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache IoTDB.
The pipe processor reads a fully
qualified Java class name and
instantiates it using Class.forName().newInstance() without any
validation or allowlisting.
This issue affects Apache IoTDB: from 1.0.0 before 2.0.10.
Users are recommended to upgrade to version 2.0.10, which fixes the issue.
> AFFECTED_PRODUCTS
ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.
> CWE DETAILED DESCRIPTIONS
CWE-470: Use of Externally-Controlled Input to Select Classes or Code - The product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code.
> HISTORIQUE DES MODIFICATIONS
Première apparition
10/07/2026 08:16
Source: NVD
📊
ENRICHISSEMENT
01/11/2026 06:59
CWE
Champ modifié: Description CWE
Ancienne valeur:
CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') - The product uses external input with reflection to select which classes or code to use, but it does not su...
Nouvelle valeur:
CWE-470: Use of Externally-Controlled Input to Select Classes or Code - The product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the...
📊
ENRICHISSEMENT
01/08/2026 06:01
CWE
Champ modifié: Description CWE
Nouvelle valeur:
CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') - The product uses external input with reflection to select which classes or code to use, but it does not su...
Total des modifications: 2
Dernière mise à jour: 5 days ago