CVE-2023-28480

TigerGraph Enterprise 3.7.0 allows users to upload and compile custom C/C++ UDF code, enabling attackers with filesystem access on a remote system to alter database behavior and bypass built-in RBAC controls. The issue affects the UDF upload/installation pathway and arises from how uploaded code ...

CVE-2023-28482

CVE-2023-28482 affects TigerGraph Enterprise 3.7.0. A single TigerGraph instance hosting multiple graphs can be accessed by multiple users, and the platform reportedly does not protect the confidentiality of uploaded data, allowing any user with upload permissions to browse data uploaded by other...

Tigergraph Code Issues Vulnerabilities

TigerGraph is one of the world's fastest and most scalable graph analytics platforms from the TigerGraph community. Enabling real-time big data graph applications. A security vulnerability exists in Tigergraph Enterprise version 3.7.0. An attacker exploiting this vulnerability could change the...

CVE-2023-28480

An issue was discovered in Tigergraph Enterprise 3.7.0. The TigerGraph platform allows users to define new User Defined Functions UDFs from C/C++ code. To support this functionality TigerGraph allows users to upload custom C/C++ code which is then compiled and installed into the platform. An...

PT-2023-21753 · Tigergraph · Tigergraph Enterprise

Name of the Vulnerable Software and Affected Versions: Tigergraph Enterprise version 3.7.0 Description: An issue was discovered in the GSQL query language, which allows users to write data to files on a remote TigerGraph server. The locations that a query is allowed to write to are configurable v...

CVE-2023-28483

TigerGraph Enterprise 3.7.0 contains a local file-write control bypass in GSQL: queries using UDFs can bypass GSQL.FileOutputPolicy and write to any file location accessible to the admin. This is triggered when GSQL queries include UDFs, allowing writes outside configured policy. Impact is descri...

CVE-2023-28481

CVE-2023-28481 affects Tigergraph Enterprise 3.7.0. The issue allows unsecured write access to the SSH authorized_keys file, enabling any code running as the tigergraph user to append their SSH public key. This can lead to password‑less SSH access using the attacker’s key. Publicly cited sources ...

PT-2023-21750 · Tigergraph · Tigergraph Enterprise

Name of the Vulnerable Software and Affected Versions: Tigergraph Enterprise version 3.7.0 Description: An issue was discovered in the TigerGraph platform, which allows users to define new User Defined Functions UDFs from C/C++ code. This functionality enables users to upload custom C/C++ code,...

CVE-2023-28483: Undefined Security Weakness

An issue was discovered in Tigergraph Enterprise 3.7.0. The GSQL query language provides users with the ability to write data to files on a remote TigerGraph server. The locations that a query is allowed to write to are configurable via the GSQL.FileOutputPolicy configuration setting. GSQL querie...

CVE-2023-22949

An issue was discovered in TigerGraph Enterprise Free Edition 3.x. There is logging of user credentials. All authenticated GSQL access requests are logged by TigerGraph in multiple places. Each request includes both the username and password of the user in an easily decodable base64 form. That...

CVE-2023-22949

An issue was discovered in TigerGraph Enterprise Free Edition 3.x. There is logging of user credentials. All authenticated GSQL access requests are logged by TigerGraph in multiple places. Each request includes both the username and password of the user in an easily decodable base64 form. That...

Design/Logic Flaw

An issue was discovered in TigerGraph Enterprise Free Edition 3.x. There is logging of user credentials. All authenticated GSQL access requests are logged by TigerGraph in multiple places. Each request includes both the username and password of the user in an easily decodable base64 form. That...

TigerGraph security vulnerabilities

TigerGraph is one of the world's fastest and most scalable graph analytics platforms from the TigerGraph community. Enabling real-time big data graph applications. A security vulnerability exists in TigerGraph Enterprise Free Edition 3.x series versions that stems from the fact that all...

PT-2023-18791 · Tigergraph · Tigergraph Enterprise Free Edition

Name of the Vulnerable Software and Affected Versions: TigerGraph Enterprise Free Edition versions 3.x Description: An issue was discovered where user credentials are logged. All authenticated GSQL access requests are logged by TigerGraph in multiple places, including both the username and passwo...

CVE-2023-22949

An issue was discovered in TigerGraph Enterprise Free Edition 3.x. There is logging of user credentials. All authenticated GSQL access requests are logged by TigerGraph in multiple places. Each request includes both the username and password of the user in an easily decodable base64 form. That...

CVE-2023-22949: Cleartext Storage of Sensitive Information

An issue was discovered in TigerGraph Enterprise Free Edition 3.x. There is logging of user credentials. All authenticated GSQL access requests are logged by TigerGraph in multiple places. Each request includes both the username and password of the user in an easily decodable base64 form. That...

CVE-2023-22949

TigerGraph Enterprise Free Edition 3.x has a credential leakage issue where all authenticated GSQL access requests are logged, with both username and password included in an easily decodable base64 form. This could allow an administrator with access to logs to harvest usernames and passwords. Aff...

CVE-2023-22949

An issue was discovered in TigerGraph Enterprise Free Edition 3.x. There is logging of user credentials. All authenticated GSQL access requests are logged by TigerGraph in multiple places. Each request includes both the username and password of the user in an easily decodable base64 form. That...

CVE-2023-22951

An issue was discovered in TigerGraph Enterprise Free Edition 3.x. It creates an authentication token for internal systems use. This token can be read from the configuration file. Using this token on the REST API provides an attacker with anonymous admin-level privileges on all REST API endpoints...

CVE-2023-22951

An issue was discovered in TigerGraph Enterprise Free Edition 3.x. It creates an authentication token for internal systems use. This token can be read from the configuration file. Using this token on the REST API provides an attacker with anonymous admin-level privileges on all REST API endpoints...