PT-2023-16375 · Yugabyte · Yugabyte Managed

Published 2023-02-09 · Updated 2023-11-10 · CVE-2023-0574

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Yugabyte Managed versions 2.0.0.0 through 2.13.0.0

Description The issue affects Yugabyte Managed, allowing accessing functionality not properly constrained by ACLs, communication channel manipulation, and authentication abuse due to Server-Side Request Forgery (SSRF), improperly controlled modification of dynamically-determined object attributes, and improper restriction of excessive authentication attempts.

Recommendations For versions 2.0.0.0 through 2.13.0.0, as a temporary workaround, consider restricting access to sensitive functionality and limiting authentication attempts to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Restriction of Excessive Authentication Attempts

SSRF

Weakness Enumeration

CWE-307

CWE-918

CWE-915

Related Identifiers

CVE-2023-0574

Affected Products

Yugabyte Managed

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2023-0574 · Security Note
• https://osv.dev/vulnerability/CVE-2023-0574 · Vendor Advisory
• https://t.me/cvenotify/43994 · Telegram Post
• https://yugabyte.com · Note
• https://t.me/cibsecurity/57824 · Telegram Post