Vulnerability Description
YugabyteDB is vulnerable to cross site scripting (XSS) via log injection. Writing invalidated user input to log files can allow an unprivileged attacker to forge log entries or inject malicious content into the logs.
CVSS Score
6.5
MEDIUM
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Yugabyte | Yugabytedb | >= 2.14.0.0, < 2.14.14.0 |
Related Weaknesses (CWE)
References
- https://www.yugabyte.com/Product
- https://www.yugabyte.com/Product
FAQ
What is CVE-2023-6002?
CVE-2023-6002 is a vulnerability with a CVSS score of 6.5 (MEDIUM). YugabyteDB is vulnerable to cross site scripting (XSS) via log injection. Writing invalidated user input to log files can allow an unprivileged attacker to forge log entries or inject malicious conten...
How severe is CVE-2023-6002?
CVE-2023-6002 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2023-6002?
Check the references section above for vendor advisories and patch information. Affected products include: Yugabyte Yugabytedb.