What is CVE-2023-4640?

CVE-2023-4640 is a medium-severity vulnerability in Yugabyte Yugabytedb, classified under Improper Access Control. CVSS score: 6.5/10. Published 2023-08-30.

How severe is CVE-2023-4640?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Vulnerability in Yugabyte Yugabytedb

CVE-2023-4640

The controller responsible for setting the logging level does not include any authorization checks to ensure the user is authenticated. This can be seen by noting that it extends Controller rather than AuthenticatedController and includes…

EPSS: 0.003 (24.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N.

Affected products

Yugabyte Yugabytedb
Yugabytedb Anywhere — versions 2.0.0

Weakness classification (CWE)

CWE-284 — Improper Access Control

References

security@yugabyte.com (Product)

Frequently asked questions

What is CVE-2023-4640?: CVE-2023-4640 is a medium-severity vulnerability in Yugabyte Yugabytedb, classified under Improper Access Control. CVSS score: 6.5/10. Published 2023-08-30.
How severe is CVE-2023-4640?: Medium severity. CVSS v3 base score is 6.5 out of 10.