Vulnerability · Published Feb 9, 2023 · Assigned by Yugabyte

CVE-2023-0745Arbitrary File Write in High Availability Backup Upload

Medium 6.7

In plain English

A medium-severity security flaw in YugabyteDB Anywhere from YugabyteDB. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).

Severity (CVSS 3.1)6.7Medium

Exploit odds (30 days)0.5%top 56.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The High Availability functionality of Yugabyte Anywhere can be abused to write arbitrary files through the backup upload endpoint by using path traversal characters. This vulnerability is associated with program files PlatformReplicationManager.Java. This issue affects YugabyteDB Anywhere: from 2.0.0.0 through 2.13.0.0

Affected products (as reported)

Vendor	Product	Versions
YugabyteDB	YugabyteDB Anywhere	2.0 – through 2.13

Weakness: CWE-23 · Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References

https://www.yugabyte.com/ issue-tracking