Lucene search

YugabyteCVELIST:CVE-2023-0574

HistoryFeb 09, 2023 - 2:55 p.m.

CVE-2023-0574 Server-Side Request Forgery

2023-02-0914:55:29

CWE-915

CWE-918

CWE-307

Yugabyte

www.cve.org

server-side request forgery

improperly controlled modification

dynamically-determined object attributes

excessive authentication attempts

yugabyte managed

acls

communication channel manipulation

authentication abuse

cve-2023-0574

6.8 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

9.8 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

54.2%

JSON

Server-Side Request Forgery (SSRF), Improperly Controlled Modification of Dynamically-Determined Object Attributes, Improper Restriction of Excessive Authentication Attempts vulnerability in YugaByte, Inc. Yugabyte Managed allows Accessing Functionality Not Properly Constrained by ACLs, Communication Channel Manipulation, Authentication Abuse.This issue affects Yugabyte Managed: from 2.0.0.0 through 2.13.0.0

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "modules": [
      "UniverseCRUDHandler.java"
    ],
    "platforms": [
      "Linux",
      "Docker",
      "Kubernetes"
    ],
    "product": "YugabyteDB Anywhere",
    "vendor": "YugabyteDB",
    "versions": [
      {
        "lessThanOrEqual": "2.13.0.0",
        "status": "affected",
        "version": "2.0.0.0",
        "versionType": "2.0 to 2.13"
      }
    ]
  }
]

References

www.yugabyte.com/

6.8 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

9.8 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

54.2%

JSON

Related for CVELIST:CVE-2023-0574