What is the CVSS score of CVE-2023-46742?

CVE-2023-46742 has a CVSS 3.1 base score of 4.8 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Cubefs are affected by CVE-2023-46742?

Organizations using CubeFS should be aware of moderate risk from CVE-2023-46742, a log file exposure vulnerability rated CVSS 4.8. This could allow unauthorized file access.. A patch is available.

How to fix or mitigate CVE-2023-46742?

During next maintenance window: Identify affected systems and apply vendor patches when convenient. Review data exposure and access controls.

Cubefs CVE-2023-46742

MEDIUM

Insertion of Sensitive Information into Log File (CWE-532)

2024-01-03 security-advisories@github.com

Information Disclosure Cubefs

4.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

4.8 MEDIUM

AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Mar 28, 2026 - 19:33 vuln.today

Patch released

Mar 28, 2026 - 19:33 nvd

Patch available

CVE Published

Jan 03, 2024 - 17:15 nvd

MEDIUM 4.8

DescriptionGitHub Advisory

CubeFS is an open-source cloud-native file storage system. CubeFS prior to version 3.3.1 was found to leak users secret keys and access keys in the logs in multiple components. When CubeCS creates new users, it leaks the users secret key. This could allow a lower-privileged user with access to the logs to retrieve sensitive information and impersonate other users with higher privileges than themselves. The issue has been patched in v3.3.1. There is no other mitigation than upgrading CubeFS.

AnalysisAI

CubeFS is an open-source cloud-native file storage system. Rated medium severity (CVSS 4.8), this vulnerability is low attack complexity.

Technical ContextAI

This vulnerability is classified under CWE-532. CubeFS is an open-source cloud-native file storage system. CubeFS prior to version 3.3.1 was found to leak users secret keys and access keys in the logs in multiple components. When CubeCS creates new users, it leaks the users secret key. This could allow a lower-privileged user with access to the logs to retrieve sensitive information and impersonate other users with higher privileges than themselves. The issue has been patched in v3.3.1. There is no other mitigation than upgrading CubeFS. Affected products include: Linuxfoundation Cubefs. Version information: version 3.3.1.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.