CVE-2024-0006mediumCWE-532

CVE-2024-0006: medium-severity vulnerability in YugabyteDB Anywhere

DB User Password Leak in Application Log

Published · Updated

Follow this CVE+ Monitor YugabyteDB Anywhere

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.4epss 0.3%
Information exposure in the logging system in Yugabyte Platform allows local attackers with access to application logs to obtain database user credentials in log files, potentially leading to unauthorized database access.
CVSS:4.0/AV:A/AC:H/AT:N/PR:H/UI:A/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L
Affected products
YugabyteDB · YugabyteDB Anywhere
Related CVEs — YugabyteDB Anywhere

In the same product, most dangerous first.

CVE-2023-6001MEDIUMPrometheus Metrics Accessible Pre-AuthenticationEPSS 0.7%CVE-2023-0574MEDIUMServer-Side Request ForgeryEPSS 0.6%CVE-2023-0745MEDIUMArbitrary File Write in High Availability Backup UploadEPSS 0.5%CVE-2024-11193MEDIUMCVE-2024-11193EPSS 0.3%CVE-2024-6908MEDIUMAdmin Can Escalate Privileges to SuperAdmin Using Manual PUT RequestEPSS 0.3%CVE-2024-6895MEDIUMInsecure Account Profile ManagementEPSS 0.2%