CVE-2023-0745
Arbitrary File Write in High Availability Backup Upload
- State
- Published
- Severity
- 6.7 Medium
- Published
- Feb 9, 2023
- Updated
- Mar 24, 2025
- Reserved
- Feb 8, 2023
Description
The High Availability functionality of Yugabyte Anywhere can be abused to write arbitrary files through the backup upload endpoint by using path traversal characters.
This vulnerability is associated with program files PlatformReplicationManager.Java.
This issue affects YugabyteDB Anywhere: from 2.0.0.0 through 2.13.0.0
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 6.7 Medium | CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H | Yugabyte |
Weaknesses
- CWE-23 Relative Path Traversal
Affected Products
| Product | Versions |
|---|---|
YugabyteDB AnywhereYugabyteDB |
|
References
- https://www.yugabyte.com/issue-tracking
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.