Yugabytedb vulnerabilities

2 known vulnerabilities in Yugabytedb from YugaByte. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  Anywhere: Improper Access Control

  CVE-2023-4640Aug 30, 2023YugabyteDB

  The controller responsible for setting the logging level does not include any authorization checks to ensure the user is authenticated. This can be seen by noting that it extends Controller rather than AuthenticatedController and includes no further checks. Th

• 9.8 Critical severity

  Yugabyte DB: Improper Authentication

  CVE-2022-37397Aug 12, 2022YugaByte

  An issue was discovered in the YugabyteDB 2.6.1 when using LDAP-based authentication in YCQL with Microsoft’s Active Directory. When anonymous or unauthenticated LDAP binding is enabled, it allows bypass of authentication with an empty password.