CVE-2023-28481

An issue was discovered in Tigergraph Enterprise 3.7.0. There is unsecured write access to SSH authorized keys file. Any code running as the tigergraph user is able to add their SSH public key into the authorised keys file. This allows an attacker to obtain password-less SSH key access by using their own SSH key.

• CWE-639

• https://neo4j.com/security/cve-2023-28481/Exploit, Third Party Advisory
• https://neo4j.com/security/cve-2023-28481/Exploit, Third Party Advisory

Published

Aug 14, 2023

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-28476Concrete CMS (previously concrete5) in versions 9.0 through …5.4
• CVE-2023-28477Concrete CMS (previously concrete5) versions 8.5.12 and belo…5.4
• CVE-2023-28478TP-Link EC-70 devices through 2.3.4 Build 20220902 rel.69498…8.8
• CVE-2023-28479An issue was discovered in Tigergraph Enterprise 3.7.0. The …8.8
• CVE-2023-2848Movim prior to version 0.22 is affected by a Cross-Site WebS…8.8
• CVE-2023-28480An issue was discovered in Tigergraph Enterprise 3.7.0. The …6.5
• CVE-2023-28482An issue was discovered in Tigergraph Enterprise 3.7.0. A si…6.5
• CVE-2023-28483An issue was discovered in Tigergraph Enterprise 3.7.0. The …8.8
• CVE-2023-28484In libxml2 before 2.10.4, parsing of certain invalid XSD sch…6.5
• CVE-2023-28485A stored cross-site scripting (Stored XSS) vulnerability in …5.4
• CVE-2023-28486Sudo before 1.9.13 does not escape control characters in log…5.3
• CVE-2023-28487Sudo before 1.9.13 does not escape control characters in sud…5.3