What is CVE-2023-6002?

CVE-2023-6002 is a medium-severity vulnerability in Yugabyte Yugabytedb, classified under Improper Output Neutralization for Logs. CVSS score: 6.5/10. Published 2023-11-08.

How severe is CVE-2023-6002?

Medium severity. CVSS v3 base score is 6.5 out of 10.

XSS in Yugabyte Yugabytedb

CVE-2023-6002

YugabyteDB is vulnerable to cross site scripting (XSS) via log injection. Writing invalidated user input to log files can allow an unprivileged attacker to forge log entries or inject malicious content into the logs.

EPSS: 0.004 (32.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N.

Affected products

Yugabyte Yugabytedb
Yugabytedb — versions 2.0.0.0, 2.14.14.0, 2.16.8.0

Weakness classification (CWE)

CWE-117 — Improper Output Neutralization for Logs
CWE-79 — Cross-site Scripting

References

security@yugabyte.com (Product)

Frequently asked questions

What is CVE-2023-6002?: CVE-2023-6002 is a medium-severity vulnerability in Yugabyte Yugabytedb, classified under Improper Output Neutralization for Logs. CVSS score: 6.5/10. Published 2023-11-08.
How severe is CVE-2023-6002?: Medium severity. CVSS v3 base score is 6.5 out of 10.