PT-2023-21750 · Tigergraph · Tigergraph Enterprise

Published 2023-08-14 · Updated 2023-08-18 · CVE-2023-28480

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Tigergraph Enterprise version 3.7.0

Description An issue was discovered in the TigerGraph platform, which allows users to define new User Defined Functions (UDFs) from C/C++ code. This functionality enables users to upload custom C/C++ code, which is then compiled and installed into the platform. An attacker with filesystem access on a remote TigerGraph system can alter the behavior of the database against the will of the database administrator, effectively bypassing the built-in Role-Based Access Control (RBAC) controls.

Recommendations For Tigergraph Enterprise version 3.7.0, consider restricting access to the custom C/C++ code upload feature to prevent unauthorized modifications to the database behavior. Additionally, monitor filesystem access and database activity to detect potential exploitation attempts. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2023-28480

Affected Products

Tigergraph Enterprise

References · 6

• 🔥 https://neo4j.com/security/cve-2023-28480 · Exploit
• https://osv.dev/vulnerability/CVE-2023-28480 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-28480 · Security Note
• https://twitter.com/CVEnew/status/1691161125235113984 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1691190503054716928 · Twitter Post
• https://t.me/cibsecurity/68474 · Telegram Post