PT-2023-18791 · Tigergraph · Tigergraph Enterprise Free Edition

Published 2023-04-14 · Updated 2025-02-07 · CVE-2023-22949

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions TigerGraph Enterprise Free Edition versions 3.x

Description An issue was discovered where user credentials are logged. All authenticated GSQL access requests are logged by TigerGraph in multiple places, including both the username and password of the user in an easily decodable base64 form. This could allow a TigerGraph administrator to harvest usernames and passwords.

Recommendations For TigerGraph Enterprise Free Edition version 3.x, consider disabling the logging of GSQL access requests as a temporary workaround until a patch is available. Restrict access to the logged data to minimize the risk of exploitation. Avoid using the username and password in the affected logging mechanism until the issue is resolved.

Exploit

Fix

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-312

Related Identifiers

CVE-2023-22949

Affected Products

Tigergraph Enterprise Free Edition

References · 6

• 🔥 https://neo4j.com/security/cve-2023-22949 · Exploit
• https://osv.dev/vulnerability/CVE-2023-22949 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-22949 · Security Note
• https://t.me/cvenotify/110482 · Telegram Post
• https://dev.tigergraph.com/forum/c/tg-community/announcements/35 · Note
• https://t.me/cibsecurity/62153 · Telegram Post