Lucene search

YugabyteCVELIST:CVE-2023-0745

HistoryFeb 09, 2023 - 4:08 p.m.

CVE-2023-0745 Arbitrary File Write in High Availability Backup Upload

2023-02-0916:08:57

CWE-23

Yugabyte

www.cve.org

yugabyte anywhere

high availability

platformreplicationmanager.java

arbitrary file write

path traversal

backup upload

cve-2023-0745

vulnerability

yugabytedb anywhere

6.7 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

9.8 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

52.2%

JSON

				The High Availability functionality of Yugabyte Anywhere can be abused to write arbitrary

files through the backup upload endpoint by using path traversal characters.

This vulnerability is associated with program files PlatformReplicationManager.Java.

This issue affects YugabyteDB Anywhere: from 2.0.0.0 through 2.13.0.0

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "platforms": [
      "Linux",
      "Docker",
      "Kubernetes"
    ],
    "product": "YugabyteDB Anywhere",
    "vendor": "YugabyteDB",
    "versions": [
      {
        "lessThanOrEqual": "2.13",
        "status": "affected",
        "version": "2.0",
        "versionType": "2.0 to 2.13"
      }
    ]
  }
]

References

www.yugabyte.com/

6.7 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

9.8 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

52.2%

JSON

Related for CVELIST:CVE-2023-0745