CVE-2023-4640
Last modified
CVE-2023-4640 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. The controller responsible for setting the logging level does not include any authorization checks to ensure the user is authenticated. This can be seen by noting that it extends Controller rather than AuthenticatedController and includes no further checks. This issue affects YugabyteDB Anywhere: from 2.0.0 through 2.17.3 . EPSS estimates a 0.33% chance of exploitation in the next 30 days.
Description
The controller responsible for setting the logging level does not include any authorization checks to ensure the user is authenticated. This can be seen by noting that it extends Controller rather than AuthenticatedController and includes no further checks. This issue affects YugabyteDB Anywhere: from 2.0.0 through 2.17.3
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Yugabyte | Yugabytedb | >= 2.0.0, <= 2.17.3.0 |
References
- https://www.yugabyte.com/Product
- https://www.yugabyte.com/Product
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2023-4640?
How severe is CVE-2023-4640?
How do I fix CVE-2023-4640?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-46388LOYTEC electronics GmbH LINX-212 and LINX-151 devices (all v…7.5
- CVE-2023-46389LOYTEC electronics GmbH LINX-212 and LINX-151 devices (all v…7.5
- CVE-2023-4639A flaw was found in Undertow, which incorrectly parses cooki…7.4
- CVE-2023-46393gougucms v4.08.18 was discovered to contain a password reset…7.5
- CVE-2023-46394A stored cross-site scripting (XSS) vulnerability in /home/u…5.4
- CVE-2023-46396Audimex 15.0.0 is vulnerable to Cross Site Scripting (XSS) i…5.4
- CVE-2023-46400KWHotel 0.47 is vulnerable to CSV Formula Injection in the a…9.8
- CVE-2023-46401KWHotel 0.47 is vulnerable to CSV Formula Injection in the i…9.8
- CVE-2023-46402git-urls 1.0.0 allows ReDOS (Regular Expression Denial of Se…7.5
- CVE-2023-46404PCRS <= 3.11 (d0de1e) “Questions” page and “Code editor” pag…9.9
- CVE-2023-46407FFmpeg prior to commit bf814 was discovered to contain an ou…5.5
- CVE-2023-46408TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to con…9.8
Are you affected by CVE-2023-4640?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST