CVE-2023-6002
Assigner: Yugabyte
Published: 2023-11-07T23:56:50.729Z
State: PUBLISHED
affected: defaultStatus: unaffected
platforms: Linux
Docker
Kubernetes
MacOS
product: YugabyteDB
vendor: YugabyteDB
versions: lessThanOrEqual: 2.14.13.0, 2.16.7.0, 2.18.3.0
status: affected
version: 2.0.0.0
versionType: semver
status: unaffected
version: 2.14.14.0
status: unaffected
version: 2.16.8.0
status: unaffected
version: 2.18.4.0
datePublic: 2023-11-07T23:03:00.000Z
descriptions: supportingMedia: base64: no
type: text/html
value: <span style="background-color: rgb(255, 255, 255);">YugabyteDB is vulnerable to cross site scripting (XSS) via log injection.&nbsp;Writing invalidated user input to log files can allow an unprivileged&nbsp;attacker to forge log entries or inject malicious content into the logs.</span><br>
value: YugabyteDB is vulnerable to cross site scripting (XSS) via log injection. Writing invalidated user input to log files can allow an unprivileged attacker to forge log entries or inject malicious content into the logs.

impacts: capecId: CAPEC-93
descriptions: value: CAPEC-93: Log Injection-Tampering-Forging
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-117
description: CWE-117: Improper Output Neutralization for Logs
type: CWE
source: discovery: UNKNOWN
title: Log Injection
x_generator: engine: Vulnogram 0.1.0-dev