1. Home
  2. CVE Database
  3. CVE-2023-4640
MEDIUM · 6.5

CVE-2023-4640

The controller responsible for setting the logging level does not include any authorization checks to ensure the user is authenticated. This can be seen by noting that it extends Controller rather tha...

Vulnerability Description

The controller responsible for setting the logging level does not include any authorization checks to ensure the user is authenticated. This can be seen by noting that it extends Controller rather than AuthenticatedController and includes no further checks. This issue affects YugabyteDB Anywhere: from 2.0.0 through 2.17.3

CVSS Score

6.5

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
LOW
Integrity
LOW
Availability
NONE

Affected Products

VendorProductVersions
YugabyteYugabytedb>= 2.0.0, <= 2.17.3.0

Related Weaknesses (CWE)

CWE-284

References

FAQ

What is CVE-2023-4640?

CVE-2023-4640 is a vulnerability with a CVSS score of 6.5 (MEDIUM). The controller responsible for setting the logging level does not include any authorization checks to ensure the user is authenticated. This can be seen by noting that it extends Controller rather tha...

How severe is CVE-2023-4640?

CVE-2023-4640 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2023-4640?

Check the references section above for vendor advisories and patch information. Affected products include: Yugabyte Yugabytedb.