1. Home
  2. CVE Database
  3. CVE-2023-6001
MEDIUM · 5.3

CVE-2023-6001

Prometheus metrics are available without authentication. These expose detailed and sensitive information about the YugabyteDB Anywhere environment.

Vulnerability Description

Prometheus metrics are available without authentication. These expose detailed and sensitive information about the YugabyteDB Anywhere environment.

CVSS Score

5.3

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
LOW
Integrity
NONE
Availability
NONE

Affected Products

VendorProductVersions
YugabyteYugabytedb>= 2.0.0, < 2.18.4.0

Related Weaknesses (CWE)

CWE-200CWE-862

References

FAQ

What is CVE-2023-6001?

CVE-2023-6001 is a vulnerability with a CVSS score of 5.3 (MEDIUM). Prometheus metrics are available without authentication. These expose detailed and sensitive information about the YugabyteDB Anywhere environment.

How severe is CVE-2023-6001?

CVE-2023-6001 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2023-6001?

Check the references section above for vendor advisories and patch information. Affected products include: Yugabyte Yugabytedb.