Vulnerability · Published Aug 30, 2023 · Assigned by Yugabyte
CVE-2023-4640Set Logging Level Without Authentication
Medium 6.5
In plain English
A medium-severity improper access control in Anywhere from YugabyteDB. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities).
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.4%top 66.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The controller responsible for setting the logging level does not include any authorization checks to ensure the user is authenticated. This can be seen by noting that it extends Controller rather than AuthenticatedController and includes no further checks. This issue affects YugabyteDB Anywhere: from 2.0.0 through 2.17.3
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| YugabyteDB | Anywhere | 2.0.0 – through 2.17.3 |
Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N