CVE-2024-11193
- State
- Published
- Severity
- 5.0 Medium
- Published
- Nov 13, 2024
- Updated
- Nov 14, 2024
- Reserved
- Nov 13, 2024
Description
An information disclosure vulnerability exists in Yugabyte Anywhere, where the LDAP bind password is logged in plaintext within application logs. This flaw results in the unintentional exposure of sensitive information in Yugabyte Anywhere logs, potentially allowing unauthorized users with access to these logs to view the LDAP bind password. An attacker with log access could exploit this vulnerability to gain unauthorized access to the LDAP server, leading to potential exposure or compromise of LDAP-managed resources This issue affects YugabyteDB Anywhere: from 2.20.0.0 before 2.20.7.0, from 2.23.0.0 before 2.23.1.0, from 2024.1.0.0 before 2024.1.3.0.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.0 Medium | CVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:H/SI:H/SA:H | Yugabyte |
| 3.1 | 6.5 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N | CISA-ADP |
Weaknesses
- CWE-532 Information Exposure Through Log Files
Affected Products
| Product | Versions |
|---|---|
YugabyteDB AnywhereYugabyteDB |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.