CVE-2023-33972 Privilege escalation from having CREATE access on a keyspace in Scylladb
Authenticated users with CREATE access can escalate privileges to read unauthorized tables in the same keyspace.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-33972?
CVE-2023-33972 is a high-severity vulnerability in scylladb, published on 27 Sep 2023. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Scylladb is a NoSQL data store using the seastar framework, compatible with Apache Cassandra. Authenticated users who are authorized to create tables in a keyspace can escalate their privileges to access a table in the same keyspace, even if they don't have permissions for that table. This issue has not yet been patched. A workaround to address this issue is to disable CREATE privileges on a keyspace, and create new tables on behalf of other users.
Weakness: CWE-269
Which versions are affected by CVE-2023-33972?
1 open source package ship an affected version, including scylladb. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
scylladb Bitnami | All versions | 5.2.9 |
Products include Scylladb Scylladb.
How do I fix CVE-2023-33972?
Upgrade scylladb to 5.2.9 or later.
Is CVE-2023-33972 being exploited?
There is no known exploitation of CVE-2023-33972 in the wild and no public exploit code.
Sources
Also known as BIT-scylladb-2023-33972, GHSA-ww5v-p45p-3vhq.