CVE-2024-11165

An information disclosure vulnerability exists in the backup configuration process where the SAS token is not masked in the configuration response. This oversight results in sensitive information leakage within the yb_backup log files, exposing the SAS token in plaintext. The leakage occurs during the backup procedure, leading to potential unauthorized access to resources associated with the SAS token. This issue affects YugabyteDB Anywhere: from 2.20.0.0 before 2.20.7.0, from 2.23.0.0 before 2.23.1.0, from 2024.1.0.0 before 2024.1.3.0.

• CWE-532

• https://github.com/yugabyte/yugabyte-db/commit/920989b6c0db0222bb7a0cce46febc76cf72d438

Published

Nov 13, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-11156An “out of bounds write” code execution vulnerability exist…7.8
• CVE-2024-11157A third-party vulnerability exists in the Rockwell Automatio…7.3
• CVE-2024-11158An “uninitialized variable” code execution vulnerability exi…8.5
• CVE-2024-11159Using remote content in OpenPGP encrypted messages can lead …4.3
• CVE-2024-1116A vulnerability was found in openBI up to 1.0.8. It has been…9.8
• CVE-2024-11160Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2024-11166For TCAS II systems using transponders compliant with MOPS e…7.1
• CVE-2024-11167An improper access control vulnerability in danny-avila/libr…5.3
• CVE-2024-11168The urllib.parse.urlsplit() and urlparse() functions imprope…6.3
• CVE-2024-11169An unhandled exception in danny-avila/librechat version 3c94…7.5
• CVE-2024-1117A vulnerability was found in openBI up to 1.0.8. It has been…9.8
• CVE-2024-11170A vulnerability in danny-avila/librechat version git 81f2936…8.8