CVE-2023-22949

An issue was discovered in TigerGraph Enterprise Free Edition 3.x. There is logging of user credentials. All authenticated GSQL access requests are logged by TigerGraph in multiple places. Each request includes both the username and password of the user in an easily decodable base64 form. That could allow a TigerGraph administrator to effectively harvest usernames/passwords.

• CWE-312
• CWE-312

• https://dev.tigergraph.com/forum/c/tg-community/announcements/35Product
• https://neo4j.com/security/cve-2023-22949/Exploit, Third Party Advisory
• https://dev.tigergraph.com/forum/c/tg-community/announcements/35Product
• https://neo4j.com/security/cve-2023-22949/Exploit, Third Party Advisory

Published

Apr 14, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-22943In Splunk Add-on Builder (AoB) versions below 4.1.2 and the …5.3
• CVE-2023-22944Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2023-22945In the GrowthExperiments extension for MediaWiki through 1.3…4.3
• CVE-2023-22946In Apache Spark versions prior to 3.4.0, applications using …9.9
• CVE-2023-22947Insecure folder permissions in the Windows installation path…7.3
• CVE-2023-22948An issue was discovered in TigerGraph Enterprise Free Editio…4.9
• CVE-2023-2295A vulnerability was found in the libreswan library. This sec…7.5
• CVE-2023-22950An issue was discovered in TigerGraph Enterprise Free Editio…6.5
• CVE-2023-22951An issue was discovered in TigerGraph Enterprise Free Editio…8.8
• CVE-2023-22952In SugarCRM before 12.0. Hotfix 91155, a crafted request can…8.8
• CVE-2023-22953In ExpressionEngine before 7.2.6, remote code execution can …8.8
• CVE-2023-22955An issue was discovered on AudioCodes VoIP desk phones throu…7.8