PT-2023-18790 · Tigergraph · Tigergraph Enterprise Free Edition

CVE-2023-22948 · Publicado 2023-04-13 · Atualizado 2023-05-04

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Média

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions TigerGraph Enterprise Free Edition versions 3.x

Description The issue allows for unsecured read access to an SSH private key. Any code running as the tigergraph user can read the SSH private key, granting an attacker password-less SSH access to all machines in the TigerGraph cluster.

Recommendations For TigerGraph Enterprise Free Edition versions 3.x, restrict access to the SSH private key to prevent unauthorized read access. As a temporary workaround, consider restricting the privileges of the tigergraph user to minimize the risk of exploitation.

Exploit

Correção

Missing Encryption of Sensitive Data

Enumeração de Fraquezas

CWE-311

Identificadores relacionados

CVE-2023-22948

Produtos afetados

Tigergraph Enterprise Free Edition

Referências · 4

• 🔥 https://neo4j.com/security/cve-2023-22948 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-22948 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-22948 · Aviso do Fabricante
• https://dev.tigergraph.com/forum/c/tg-community/announcements/35 · Aviso do Fabricante