Paper/Archive/CVE-2022-37397

CVE-2022-37397

YugaByte, Inc. Yugabyte DB — The software is vulnerable when using LDAP-based authentication in YCQL with Microsoft’s Active Directory

EPSS 0.9%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 60.8.608 × 2012.2 No public exploit+100.0 SSVC exploitation: unknown+100.0

Description · from the CVE record

An issue was discovered in the YugabyteDB 2.6.1 when using LDAP-based authentication in YCQL with Microsoft’s Active Directory. When anonymous or unauthenticated LDAP binding is enabled, it allows bypass of authentication with an empty password.

Affected

ProductAffectedFixed inSource

Yugabyte DB2.6.1.0–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Yugabyte (CNA)8.3CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

References

refyugabyte.com