CVE-2023-6002

MEDIUM

YugabyteDB 2.14.0.0-2.14.13.9 - Cross-Site Scripting via Log Injection

Title source: llm
STIX 2.1

Description

YugabyteDB is vulnerable to cross site scripting (XSS) via log injection. Writing invalidated user input to log files can allow an unprivileged attacker to forge log entries or inject malicious content into the logs.

References (1)

Core 1
Core References

Scores

CVSS v3 6.5
EPSS 0.0040
EPSS Percentile 32.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-79 CWE-117
Status published
Products (1)
yugabyte/yugabytedb 2.14.0.0 - 2.14.14.0
Published Nov 08, 2023
Tracked Since Feb 18, 2026