by Kastro
Paper/Archive/CVE-2023-0574

CVE-2023-0574

YugabyteDB YugabyteDB Anywhere — Server-Side Request Forgery

EPSS 0.6%CVSS 9.8
critical.is priorityof 100
40
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 50.5.505 × 2010.1No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Server-Side Request Forgery (SSRF), Improperly Controlled Modification of Dynamically-Determined Object Attributes, Improper Restriction of Excessive Authentication Attempts vulnerability in YugaByte, Inc. Yugabyte Managed allows Accessing Functionality Not Properly Constrained by ACLs, Communication Channel Manipulation, Authentication Abuse.This issue affects Yugabyte Managed: from 2.0.0.0 through 2.13.0.0

Affected

ProductAffectedFixed inSource
YugabyteDB Anywhere2.0.0.0 – 2.13.0.0–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Yugabyte (CNA)6.8CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

refyugabyte.com