CVE-2023-0574mediumCWE-307CWE-915CWE-918

CVE-2023-0574: medium-severity vulnerability in YugabyteDB Anywhere

Server-Side Request Forgery

Published · Updated

Follow this CVE+ Monitor YugabyteDB Anywhere

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.8epss 0.6%
Server-Side Request Forgery (SSRF), Improperly Controlled Modification of Dynamically-Determined Object Attributes, Improper Restriction of Excessive Authentication Attempts vulnerability in YugaByte, Inc. Yugabyte Managed allows Accessing Functionality Not Properly Constrained by ACLs, Communication Channel Manipulation, Authentication Abuse.This issue affects Yugabyte Managed: from 2.0.0.0 through 2.13.0.0
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Affected products
YugabyteDB · YugabyteDB Anywhere
Related CVEs — YugabyteDB Anywhere

In the same product, most dangerous first.

CVE-2023-6001MEDIUMPrometheus Metrics Accessible Pre-AuthenticationEPSS 0.7%CVE-2023-0745MEDIUMArbitrary File Write in High Availability Backup UploadEPSS 0.5%CVE-2024-11193MEDIUMCVE-2024-11193EPSS 0.3%CVE-2024-0006MEDIUMDB User Password Leak in Application LogEPSS 0.3%CVE-2024-6908MEDIUMAdmin Can Escalate Privileges to SuperAdmin Using Manual PUT RequestEPSS 0.3%CVE-2024-6895MEDIUMInsecure Account Profile ManagementEPSS 0.2%