CVE-2023-4640 Set Logging Level Without Authentication

The controller responsible for setting the logging level does not include any authorization checks to ensure the user is authenticated. This can be seen by noting that it extends Controller rather than AuthenticatedController and includes no further checks. This issue affects YugabyteDB Anywhere:...

CVE-2023-4640 Set Logging Level Without Authentication

The controller responsible for setting the logging level does not include any authorization checks to ensure the user is authenticated. This can be seen by noting that it extends Controller rather than AuthenticatedController and includes no further checks. This issue affects YugabyteDB Anywhere:...

CVE-2023-4640

The CVE-2023-4640 entry concerns YugabyteDB Anywhere, affected in versions 2.0.0 through 2.17.3, where the logging level controller lacks authentication checks. Root cause: the controller extends Controller with no auth checks, enabling potential unauthorized changes to logging settings. Impact: ...

CVE-2023-4640 Set Logging Level Without Authentication

The controller responsible for setting the logging level does not include any authorization checks to ensure the user is authenticated. This can be seen by noting that it extends Controller rather than AuthenticatedController and includes no further checks. This issue affects YugabyteDB Anywhere:...

PT-2023-30002 · Yugabyte · Yugabytedb

Name of the Vulnerable Software and Affected Versions: YugabyteDB Anywhere versions 2.0.0 through 2.17.3 Description: The issue is related to the lack of authorization checks in the controller responsible for setting the logging level. This controller does not ensure that the user is authenticate...

YugabyteDB 安全漏洞

YugabyteDB is a high-performance transactional distributed SQL database for cloud-native applications from Yugabyte, Inc. A security vulnerability exists in YugabyteDB Anywhere versions 2.0.0 through 2.17.3, which stems from the controller responsible for setting the logging level does not includ...

CVE-2023-0745

The High Availability functionality of Yugabyte Anywhere can be abused to write arbitrary files through the backup upload endpoint by using path traversal characters. This vulnerability is associated with program files PlatformReplicationManager.Java. This issue affects YugabyteDB Anywhere: from...

Path traversal

The High Availability functionality of Yugabyte Anywhere can be abused to write arbitrary files through the backup upload endpoint by using path traversal characters. This vulnerability is associated with program files PlatformReplicationManager.Java. This issue affects YugabyteDB Anywhere: from...

CVE-2023-0745 Arbitrary File Write in High Availability Backup Upload

The High Availability functionality of Yugabyte Anywhere can be abused to write arbitrary files through the backup upload endpoint by using path traversal characters. This vulnerability is associated with program files PlatformReplicationManager.Java. This issue affects YugabyteDB Anywhere: from...

Yugabyte YugabyteDB Managed 安全漏洞

YugabyteDB Managed is Yugabyte's fully managed YugabyteDB-as-a-Service, eliminating the operational overhead of managing a database. A security vulnerability exists in Yugabyte YugabyteDB Managed. No information about this vulnerability is available at this time, please stay tuned to CNNVD or the...

Yugabyte YugabyteDB Managed 路径遍历漏洞

YugabyteDB Managed is Yugabyte's fully managed YugabyteDB-as-a-Service, eliminating the operational overhead of managing a database. A path traversal vulnerability exists in Yugabyte YugabyteDB Managed. No information about this vulnerability is available at this time, please stay tuned to CNNVD ...

Yugabyte YugabyteDB Managed 安全漏洞

YugabyteDB Managed is Yugabyte's fully managed YugabyteDB-as-a-Service, eliminating the operational overhead of managing a database. A security vulnerability exists in Yugabyte YugabyteDB Managed. No information about this vulnerability is available at this time, please stay tuned to CNNVD or the...

This Week in Spring - January 31st, 2023

Hi, Spring fans! Welcome to another installment of This Week in Spring! I'm not going to spend too much time here in the preamble because a today's both my birthday and my late father's birthday and b I got the worst gift ever: COVID-19. Sigh. So, I'm going back to bed. Without further ado, let's...

This Week in Spring - January 31st, 2023

Hi, Spring fans! Welcome to another installment of This Week in Spring! I'm not going to spend too much time here in the preamble because a today's both my birthday and my late father's birthday and b I got the worst gift ever: COVID-19. Sigh. So, I'm going back to bed. Without further ado, let's...

CVE-2022-37397

An issue was discovered in the YugabyteDB 2.6.1 when using LDAP-based authentication in YCQL with Microsoft’s Active Directory. When anonymous or unauthenticated LDAP binding is enabled, it allows bypass of authentication with an empty password...

Authentication flaw

An issue was discovered in the YugabyteDB 2.6.1 when using LDAP-based authentication in YCQL with Microsoft’s Active Directory. When anonymous or unauthenticated LDAP binding is enabled, it allows bypass of authentication with an empty password...

CVE-2022-37397 The software is vulnerable when using LDAP-based authentication in YCQL with Microsoft’s Active Directory

An issue was discovered in the YugabyteDB 2.6.1 when using LDAP-based authentication in YCQL with Microsoft’s Active Directory. When anonymous or unauthenticated LDAP binding is enabled, it allows bypass of authentication with an empty password...

CVE-2022-37397

CVE-2022-37397 affects YugabyteDB 2.6.1 when using LDAP-based authentication in YCQL with Microsoft AD. If anonymous or unauthenticated LDAP binding is enabled, authentication can be bypassed with an empty password. Connected sources provide no exploitation details. Practical impact is authentica...

CVE-2022-37397 The software is vulnerable when using LDAP-based authentication in YCQL with Microsoft’s Active Directory

An issue was discovered in the YugabyteDB 2.6.1 when using LDAP-based authentication in YCQL with Microsoft’s Active Directory. When anonymous or unauthenticated LDAP binding is enabled, it allows bypass of authentication with an empty password...

PT-2022-23972 · Yugabyte +1 · Yugabytedb +1

Name of the Vulnerable Software and Affected Versions: YugabyteDB version 2.6.1 Description: An issue was discovered when using LDAP-based authentication in YCQL with Microsoft’s Active Directory. If anonymous or unauthenticated LDAP binding is enabled, it allows bypass of authentication with an...