Yugabyte Platform CVE-2024-0006

Q: What is the CVSS score of CVE-2024-0006?

CVE-2024-0006 has a CVSS 4.0 base score of 5.4 (Medium). CVSS vector: CVSS:4.0/AV:A/AC:H/AT:N/PR:H/UI:A/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

MEDIUM

Insertion of Sensitive Information into Log File (CWE-532)

2024-07-19 security@yugabyte.com

Information Disclosure

5.4

CVSS 4.0 · Vendor: yugabyte

Severity by source

Vendor (yugabyte) PRIMARY

5.4 MEDIUM

CVSS:4.0/AV:A/AC:H/AT:N/PR:H/UI:A/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (yugabyte) · only source for this CVE.

CVSS VectorVendor: yugabyte

CVSS:4.0/AV:A/AC:H/AT:N/PR:H/UI:A/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Adjacent

Attack Complexity

High

Privileges Required

High

User Interaction

Scope

Lifecycle Timeline

CVE Published

Jul 19, 2024 - 15:15 cve.org

MEDIUM 5.4

DescriptionCVE.org

Information exposure in the logging system in Yugabyte Platform allows local attackers with access to application logs to obtain database user credentials in log files, potentially leading to unauthorized database access.

AnalysisAI

Technical ContextAI

This vulnerability is classified under CWE-532. Information exposure in the logging system in Yugabyte Platform allows local attackers with access to application logs to obtain database user credentials in log files, potentially leading to unauthorized database access.

Affected ProductsAI

Yugabyte Platform.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.