What is CVE-2023-0745?

CVE-2023-0745 is a medium-severity vulnerability in Yugabyte Yugabytedb Managed, classified under Relative Path Traversal. CVSS score: 6.7/10. Published 2023-02-09.

How severe is CVE-2023-0745?

Medium severity. CVSS v3 base score is 6.7 out of 10.

Path Traversal in Yugabyte Yugabytedb Managed

CVE-2023-0745

The High Availability functionality of Yugabyte Anywhere can be abused to write arbitrary files through the backup upload endpoint by using path traversal characters. This vulnerability is associated with program files PlatformReplicationManager.Java. This issue affects YugabyteDB Anywhere: from 2.0.0.0 through 2.13.0.0

EPSS: 0.005 (40.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.7 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.

Affected products

Yugabyte Yugabytedb_managed
Yugabytedb Anywhere — versions 2.0

Weakness classification (CWE)

References

security@yugabyte.com (issue-tracking, Product)

Frequently asked questions

What is CVE-2023-0745?: CVE-2023-0745 is a medium-severity vulnerability in Yugabyte Yugabytedb Managed, classified under Relative Path Traversal. CVSS score: 6.7/10. Published 2023-02-09.
How severe is CVE-2023-0745?: Medium severity. CVSS v3 base score is 6.7 out of 10.