CVE-2023-0745
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.5 High
AI Score
Confidence
High
0.002 Low
EPSS
Percentile
52.2%
The High Availability functionality of Yugabyte Anywhere can be abused to write arbitrary
files through the backup upload endpoint by using path traversal characters.
This vulnerability is associated with program files PlatformReplicationManager.Java.
This issue affects YugabyteDB Anywhere: from 2.0.0.0 through 2.13.0.0
Affected configurations
| CPE | Name | Operator | Version |
|---|---|---|---|
| yugabyte:yugabytedb_managed | yugabyte yugabytedb managed | le | 2.13 |
CNA Affected
[
{
"defaultStatus": "unaffected",
"platforms": [
"Linux",
"Docker",
"Kubernetes"
],
"product": "YugabyteDB Anywhere",
"vendor": "YugabyteDB",
"versions": [
{
"lessThanOrEqual": "2.13",
"status": "affected",
"version": "2.0",
"versionType": "2.0 to 2.13"
}
]
}
]References
Related
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.5 High
AI Score
Confidence
High
0.002 Low
EPSS
Percentile
52.2%