CVE-2023-6002

2023-11-0800:15:08

CWE-117

CWE-79

[email protected]

web.nvd.nist.gov

yugabytedb

xss

vulnerability

log injection

nvd

cve-2023-6002

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

0.0005 Low

EPSS

Percentile

17.1%

JSON

YugabyteDB is vulnerable to cross site scripting (XSS) via log injection. Writing invalidated user input to log files can allow an unprivileged attacker to forge log entries or inject malicious content into the logs.

Affected configurations

NVD

Node

yugabyteyugabytedbRange2.14.0.0–2.14.14.0

yugabyteyugabytedbRange2.16.0.0–2.16.8.0

yugabyteyugabytedbRange2.18.0.0–2.18.4.0

CPENameOperatorVersion
yugabyte:yugabytedbyugabyte yugabytedblt2.14.14.0
yugabyte:yugabytedbyugabyte yugabytedblt2.16.8.0
yugabyte:yugabytedbyugabyte yugabytedblt2.18.4.0

CPE	Name	Operator	Version
yugabyte:yugabytedb	yugabyte yugabytedb	lt	2.14.14.0
yugabyte:yugabytedb	yugabyte yugabytedb	lt	2.16.8.0
yugabyte:yugabytedb	yugabyte yugabytedb	lt	2.18.4.0

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "platforms": [
      "Linux",
      "Docker",
      "Kubernetes",
      "MacOS"
    ],
    "product": "YugabyteDB",
    "vendor": "YugabyteDB",
    "versions": [
      {
        "lessThanOrEqual": "2.14.13.0, 2.16.7.0, 2.18.3.0",
        "status": "affected",
        "version": "2.0.0.0",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "2.14.14.0"
      },
      {
        "status": "unaffected",
        "version": "2.16.8.0"
      },
      {
        "status": "unaffected",
        "version": "2.18.4.0"
      }
    ]
  }
]