PT-2023-18791 · Tigergraph · Tigergraph Enterprise Free Edition

Publicado 2023-04-14 · Atualizado 2025-02-07 · CVE-2023-22949

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Média

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions TigerGraph Enterprise Free Edition versions 3.x

Description An issue was discovered where user credentials are logged. All authenticated GSQL access requests are logged by TigerGraph in multiple places, including both the username and password of the user in an easily decodable base64 form. This could allow a TigerGraph administrator to harvest usernames and passwords.

Recommendations For TigerGraph Enterprise Free Edition version 3.x, consider disabling the logging of GSQL access requests as a temporary workaround until a patch is available. Restrict access to the logged data to minimize the risk of exploitation. Avoid using the username and password in the affected logging mechanism until the issue is resolved.

Exploit

Correção

Cleartext Storage of Sensitive Information

Enumeração de Fraquezas

CWE-312

Identificadores relacionados

CVE-2023-22949

Produtos afetados

Tigergraph Enterprise Free Edition

Referências · 6

• 🔥 https://neo4j.com/security/cve-2023-22949 · Exploit
• https://t.me/cvenotify/110482 · Publicação no Telegram
• https://dev.tigergraph.com/forum/c/tg-community/announcements/35 · Nota
• https://osv.dev/vulnerability/CVE-2023-22949 · Aviso do Fabricante
• https://t.me/cibsecurity/62153 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-22949 · Nota de Segurança