PT-2023-21752 · Tigergraph · Tigergraph Enterprise

Publicado 2023-08-14 · Atualizado 2023-08-21 · CVE-2023-28482

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Tigergraph Enterprise version 3.7.0

Description An issue was discovered in Tigergraph Enterprise where a single instance can host multiple graphs accessed by multiple users. The platform does not protect the confidentiality of uploaded data, allowing any user with upload permissions to browse data uploaded by other users, regardless of their permissions.

Recommendations For Tigergraph Enterprise version 3.7.0, consider restricting access to sensitive data and implementing additional access controls to minimize the risk of unauthorized data browsing until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2023-28482

Produtos afetados

Tigergraph Enterprise

Referências · 6

• 🔥 https://neo4j.com/security/cve-2023-28482 · Exploit
• https://t.me/cibsecurity/68472 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-28482 · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/1691189490419728385 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2023-28482 · Nota de Segurança
• https://twitter.com/CVEnew/status/1691161126476648449 · Publicação no Twitter