CVE-2024-27905

CVE-2024-27905: Apache Aurora: padding oracle can allow construction an authentication cookie

Vendor Apache Software Foundation

Product Apache Aurora

Weakness CWE-200 · Info exposure

Published February 27, 2024

Last update April 22, 2025

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

** UNSUPPORTED WHEN ASSIGNED ** Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Aurora. An endpoint exposing internals to unauthenticated users can be used as a "padding oracle" allowing an anonymous attacker to construct a valid authentication cookie. Potentially this could be combined with vulnerabilities in other components to achieve remote code execution. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

Key dates

02Disclosure timeline

February 27, 2024 CVE published

April 22, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-27905 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/200.html AskarLabs — CWE-200 write-up Exposure of Sensitive Information to an Unauthorized Actor

Related vulnerabilities

04Related CVE

CVE-2026-15012 Demi <= 0.0.8 - Unauthenticated Information Exposure to Arbitrary Directory Copy CVE-2026-2571 Download Manager <= 3.3.49 - Missing Authorization to Authenticated (Subscriber+) User Email Enumeration via 'user' Parameter CVE-2026-2128 Breeze Cache <= 2.5.2 - Unauthenticated Exposure of Sensitive Information to an Unauthorized Actor via Crafted Login Cookie CVE-2026-1371 Tutor LMS <= 3.9.5 - Authenticated (Subscriber+) Information Disclosure in Coupon Details via 'tutor_coupon_details' AJAX Action CVE-2026-3058 Seraphinite Accelerator <= 2.28.14 - Authenticated (Subscriber+) Exposure of Sensitive Information to an Unauthorized Actor