CVE-2023-22949

An issue was discovered in TigerGraph Enterprise Free Edition 3.x. There is logging of user credentials. All authenticated GSQL access requests are logged by TigerGraph in multiple places. Each request includes both the username and password of the user in an easily decodable base64 form. That...

CVE-2023-22949: Cleartext Storage of Sensitive Information

An issue was discovered in TigerGraph Enterprise Free Edition 3.x. There is logging of user credentials. All authenticated GSQL access requests are logged by TigerGraph in multiple places. Each request includes both the username and password of the user in an easily decodable base64 form. That...

PT-2023-18791 · Tigergraph · Tigergraph Enterprise Free Edition

Name of the Vulnerable Software and Affected Versions: TigerGraph Enterprise Free Edition versions 3.x Description: An issue was discovered where user credentials are logged. All authenticated GSQL access requests are logged by TigerGraph in multiple places, including both the username and passwo...

TigerGraph 安全漏洞

TigerGraph is one of the world's fastest and most scalable graph analytics platforms from the TigerGraph community. Enabling real-time big data graph applications. A security vulnerability exists in TigerGraph Enterprise Free Edition version 3.x. The vulnerability stems from the presence of...

CVE-2023-22948: Missing Encryption of Sensitive Data

An issue was discovered in TigerGraph Enterprise Free Edition 3.x. There is unsecured read access to an SSH private key. Any code that runs as the tigergraph user is able to read the SSH private key. With this, an attacker is granted password-less SSH access to all machines in the TigerGraph...

CVE-2023-22950

TigerGraph CVE-2023-22950 affects TigerGraph Enterprise Free Edition 3.x. The issue enables data loading jobs in gsql_server, created by any user with designer permissions, to read sensitive data from arbitrary locations. The core impact is sensitive data exposure (confidentiality impact H) with ...

CVE-2023-22951: Incorrect Default Permissions

An issue was discovered in TigerGraph Enterprise Free Edition 3.x. It creates an authentication token for internal systems use. This token can be read from the configuration file. Using this token on the REST API provides an attacker with anonymous admin-level privileges on all REST API endpoints...

CVE-2023-22950: Incorrect Resource Transfer Between Spheres

An issue was discovered in TigerGraph Enterprise Free Edition 3.x. Data loading jobs in gsqlserver, created by any user with designer permissions, can read sensitive data from arbitrary locations...