Paper/Archive/CVE-2023-0745

CVE-2023-0745

YugabyteDB YugabyteDB Anywhere — Arbitrary File Write in High Availability Backup Upload

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 43.7.437 × 208.7 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

The High Availability functionality of Yugabyte Anywhere can be abused to write arbitrary files through the backup upload endpoint by using path traversal characters. This vulnerability is associated with program files PlatformReplicationManager.Java. This issue affects YugabyteDB Anywhere: from 2.0.0.0 through 2.13.0.0

Affected

ProductAffectedFixed inSource

YugabyteDB Anywhere2.0 – 2.13–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Yugabyte (CNA)6.7CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

refyugabyte.com