CVE-2023-22951

TigerGraph Enterprise Free Edition 3.x stores an internal authentication token in the configuration file. An attacker who can read the config file can use that token on the REST API to obtain anonymous admin-level privileges on all REST API endpoints. The issue is documented across multiple feeds...

CVE-2023-22949

TigerGraph Enterprise Free Edition 3.x has a credential leakage issue where all authenticated GSQL access requests are logged, with both username and password included in an easily decodable base64 form. This could allow an administrator with access to logs to harvest usernames and passwords. Aff...