YugaByte vulnerabilities
We track 4 vulnerabilities in YugaByte products across 3 products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on August 30, 2023.
Latest YugaByte vulnerabilities
- 7.5 High severity
Anywhere: Improper Access Control
The controller responsible for setting the logging level does not include any authorization checks to ensure the user is authenticated. This can be seen by noting that it extends Controller rather than AuthenticatedController and includes no further checks. Th
- 9.8 Critical severity
YugabyteDB Anywhere: Improper Limitation of a Pathname to a Restricted Directory
The High Availability functionality of Yugabyte Anywhere can be abused to write arbitrary files through the backup upload endpoint by using path traversal characters. This vulnerability is associated with program files PlatformReplicationManager.Java. This iss
- 9.8 Critical severity
YugabyteDB Anywhere: Improper Restriction of Excessive Authentication Attempts
Server-Side Request Forgery (SSRF), Improperly Controlled Modification of Dynamically-Determined Object Attributes, Improper Restriction of Excessive Authentication Attempts vulnerability in YugaByte, Inc. Yugabyte Managed allows Accessing Functionality Not Pr
- 9.8 Critical severity
Yugabyte DB: Improper Authentication
An issue was discovered in the YugabyteDB 2.6.1 when using LDAP-based authentication in YCQL with Microsoft’s Active Directory. When anonymous or unauthenticated LDAP binding is enabled, it allows bypass of authentication with an empty password.