Vulnerability · Published Nov 7, 2023 · Assigned by Yugabyte
CVE-2023-6002Log Injection
Medium 6.5
In plain English
A medium-severity security flaw in YugabyteDB from YugabyteDB. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.4%top 65.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
YugabyteDB is vulnerable to cross site scripting (XSS) via log injection. Writing invalidated user input to log files can allow an unprivileged attacker to forge log entries or inject malicious content into the logs.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| YugabyteDB | YugabyteDB | 2.0.0.0 – through 2.14.13.0, 2.16.7.0, 2.18.3.0 |
Weakness: CWE-117 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N