« Volver al listado

CVE-2023-6002

Estado: ModificadaMedia (6.1)—

YugabyteDB is vulnerable to cross site scripting (XSS) via log injection. Writing invalidated user input to log files can allow an unprivileged attacker to forge log entries or inject malicious content into the logs.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Yugabyte — Yugabytedb

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-6002",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-6002",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-09-04T13:19:18.227681Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security@yugabyte.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.5,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@yugabyte.com",
      "affectedData": [
        {
          "vendor": "YugabyteDB",
          "product": "YugabyteDB",
          "versions": [
            {
              "status": "affected",
              "version": "2.0.0.0",
              "versionType": "semver",
              "lessThanOrEqual": "2.14.13.0, 2.16.7.0, 2.18.3.0"
            },
            {
              "status": "unaffected",
              "version": "2.14.14.0"
            },
            {
              "status": "unaffected",
              "version": "2.16.8.0"
            },
            {
              "status": "unaffected",
              "version": "2.18.4.0"
            }
          ],
          "platforms": [
            "Linux",
            "Docker",
            "Kubernetes",
            "MacOS"
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2023-11-08T00:15:08.360",
  "references": [
    {
      "url": "https://www.yugabyte.com/",
      "tags": [
        "Product"
      ],
      "source": "security@yugabyte.com"
    },
    {
      "url": "https://www.yugabyte.com/",
      "tags": [
        "Product"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@yugabyte.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-117"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "YugabyteDB is vulnerable to cross site scripting (XSS) via log injection. Writing invalidated user input to log files can allow an unprivileged attacker to forge log entries or inject malicious content into the logs.\n"
    },
    {
      "lang": "es",
      "value": "YugabyteDB es vulnerable a Cross-Site Scripting (XSS) mediante inyección de registros. Escribir entradas de usuario invalidadas en archivos de registro puede permitir que un atacante falsifique entradas de registro o inyecte contenido malicioso en los registros."
    }
  ],
  "lastModified": "2026-06-17T06:49:49.940",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:yugabyte:yugabytedb:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "85CD3E3B-F677-4F1E-8F18-865801C6C734",
              "versionEndExcluding": "2.14.14.0",
              "versionStartIncluding": "2.14.0.0"
            },
            {
              "criteria": "cpe:2.3:a:yugabyte:yugabytedb:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "10B0E240-9B84-4C09-88D3-56662C686502",
              "versionEndExcluding": "2.16.8.0",
              "versionStartIncluding": "2.16.0.0"
            },
            {
              "criteria": "cpe:2.3:a:yugabyte:yugabytedb:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "963CE6ED-0A17-4189-9E37-F137E3A313F0",
              "versionEndExcluding": "2.18.4.0",
              "versionStartIncluding": "2.18.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@yugabyte.com"
}