PT-2023-21752 · Tigergraph · Tigergraph Enterprise

Published 2023-08-14 · Updated 2023-08-21 · CVE-2023-28482

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Tigergraph Enterprise version 3.7.0

Description An issue was discovered in Tigergraph Enterprise where a single instance can host multiple graphs accessed by multiple users. The platform does not protect the confidentiality of uploaded data, allowing any user with upload permissions to browse data uploaded by other users, regardless of their permissions.

Recommendations For Tigergraph Enterprise version 3.7.0, consider restricting access to sensitive data and implementing additional access controls to minimize the risk of unauthorized data browsing until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2023-28482

Affected Products

Tigergraph Enterprise

References · 6

• 🔥 https://neo4j.com/security/cve-2023-28482 · Exploit
• https://osv.dev/vulnerability/CVE-2023-28482 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-28482 · Security Note
• https://t.me/cibsecurity/68472 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1691189490419728385 · Twitter Post
• https://twitter.com/CVEnew/status/1691161126476648449 · Twitter Post