PT-2022-23972 · Microsoft+1 · Active Directory+1

Published 2022-08-12 · Updated 2022-08-16 · CVE-2022-37397

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions YugabyteDB version 2.6.1

Description An issue was discovered when using LDAP-based authentication in YCQL with Microsoft’s Active Directory. If anonymous or unauthenticated LDAP binding is enabled, it allows bypass of authentication with an empty password.

Recommendations For YugabyteDB version 2.6.1, consider disabling anonymous or unauthenticated LDAP binding to prevent authentication bypass. As a temporary workaround, restrict access to the LDAP authentication module until a patch is available.

Fix

Improper Authentication

Weakness Enumeration

CWE-16

CWE-287

Related Identifiers

CVE-2022-37397

Affected Products

Active Directory

Yugabytedb

References · 3

• https://osv.dev/vulnerability/CVE-2022-37397 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-37397 · Security Note
• https://yugabyte.com · Vendor Advisory