CVE-2023-0745mediumCWE-23

CVE-2023-0745: medium-severity vulnerability in YugabyteDB Anywhere

Arbitrary File Write in High Availability Backup Upload

Published · Updated

Follow this CVE+ Monitor YugabyteDB Anywhere

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.7epss 0.5%
The High Availability functionality of Yugabyte Anywhere can be abused to write arbitrary files through the backup upload endpoint by using path traversal characters. This vulnerability is associated with program files PlatformReplicationManager.Java. This issue affects YugabyteDB Anywhere: from 2.0.0.0 through 2.13.0.0
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected products
YugabyteDB · YugabyteDB Anywhere
Related CVEs — YugabyteDB Anywhere

In the same product, most dangerous first.

CVE-2023-6001MEDIUMPrometheus Metrics Accessible Pre-AuthenticationEPSS 0.7%CVE-2023-0574MEDIUMServer-Side Request ForgeryEPSS 0.6%CVE-2024-11193MEDIUMCVE-2024-11193EPSS 0.3%CVE-2024-0006MEDIUMDB User Password Leak in Application LogEPSS 0.3%CVE-2024-6908MEDIUMAdmin Can Escalate Privileges to SuperAdmin Using Manual PUT RequestEPSS 0.3%CVE-2024-6895MEDIUMInsecure Account Profile ManagementEPSS 0.2%