CVE-2023-6002 Log Injection
An unprivileged attacker can inject malicious content into YugabyteDB logs, potentially leading to cross-site scripting attacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-6002?
CVE-2023-6002 is a medium-severity cross-site scripting vulnerability in YugabyteDB, published on 7 Nov 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
YugabyteDB is vulnerable to cross site scripting (XSS) via log injection. Writing invalidated user input to log files can allow an unprivileged attacker to forge log entries or inject malicious content into the logs.
Which versions are affected by CVE-2023-6002?
It affects 1 product.
Products include Yugabyte Yugabytedb.
How do I fix CVE-2023-6002?
No fix has been published for CVE-2023-6002 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2023-6002 being exploited?
There is no known exploitation of CVE-2023-6002 in the wild and no public exploit code.
Other vulnerabilities in YugabyteDB
- CVE-2022-37397 The software is vulnerable when using LDAP-based authentication in YCQL with Microsoft’s Active Directory
- CVE-2024-41435 Memory corruption in n/a
- CVE-2023-0575 Remote Code Execution
- CVE-2023-4640 Set Logging Level Without Authentication
- CVE-2023-6001 Prometheus Metrics Accessible Pre-Authentication
Sources
Also known as GHSA-p56w-h56q-c97x.