PT-2023-18793 · Tigergraph · Tigergraph Enterprise Free Edition

Published 2023-04-13 · Updated 2023-05-04 · CVE-2023-22950

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions TigerGraph Enterprise Free Edition versions 3.x

Description An issue allows data loading jobs in gsql server to read sensitive data from arbitrary locations. This issue affects jobs created by any user with designer permissions.

Recommendations For TigerGraph Enterprise Free Edition versions 3.x, consider restricting designer permissions to minimize the risk of exploitation until a patch is available. As a temporary workaround, restrict access to sensitive data locations to prevent unauthorized reading.

Exploit

Fix

Weakness Enumeration

CWE-669

Related Identifiers

CVE-2023-22950

Affected Products

Tigergraph Enterprise Free Edition

References · 4

• 🔥 https://neo4j.com/security/cve-2023-22950 · Exploit
• https://osv.dev/vulnerability/CVE-2023-22950 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-22950 · Security Note
• https://dev.tigergraph.com/forum/c/tg-community/announcements/35 · Vendor Advisory