Cloudbeaver
Monthly
Information disclosure in CloudBeaver through 25.3.5 allows an authenticated remote web session holder to read other users' exported LOB files from the shared LOB-export folder served by WebSQLResultServlet. Exploitation is practically constrained: the attacker must already have a valid session, know or guess the victim's table and column names, and enumerate second-resolution timestamps to reconstruct valid export filenames, and the impact is limited to confidentiality. No public exploit has been identified at time of analysis, and the assessed vector plus these prerequisites indicate genuinely low real-world risk, with the greatest concern in multi-tenant instances shared by untrusted users.
Missing authorization in the CloudBeaver web database manager (versions through 25.3.5) lets any authenticated member of a shared project - including users granted view-only access - persist attacker-supplied credentials onto a shared connection without holding datasource-edit permission. The initConnection GraphQL mutation accepts the saveCredentials and sharedCredentials flags together with attacker-chosen authProperties, so other users who later open that shared connection authenticate to the underlying database under the attacker's identity rather than their own. Exploitation requires a valid low-privilege account (authenticated, CVSS PR:L), a multi-user deployment that actually uses the shared-projects/team collaboration feature, and at least one subsequent victim connecting to the tampered connection; no public exploit code has been identified at time of analysis.
Information disclosure in CloudBeaver through 25.3.5 allows an authenticated remote web session holder to read other users' exported LOB files from the shared LOB-export folder served by WebSQLResultServlet. Exploitation is practically constrained: the attacker must already have a valid session, know or guess the victim's table and column names, and enumerate second-resolution timestamps to reconstruct valid export filenames, and the impact is limited to confidentiality. No public exploit has been identified at time of analysis, and the assessed vector plus these prerequisites indicate genuinely low real-world risk, with the greatest concern in multi-tenant instances shared by untrusted users.
Missing authorization in the CloudBeaver web database manager (versions through 25.3.5) lets any authenticated member of a shared project - including users granted view-only access - persist attacker-supplied credentials onto a shared connection without holding datasource-edit permission. The initConnection GraphQL mutation accepts the saveCredentials and sharedCredentials flags together with attacker-chosen authProperties, so other users who later open that shared connection authenticate to the underlying database under the attacker's identity rather than their own. Exploitation requires a valid low-privilege account (authenticated, CVSS PR:L), a multi-user deployment that actually uses the shared-projects/team collaboration feature, and at least one subsequent victim connecting to the tampered connection; no public exploit code has been identified at time of analysis.