CVE-2023-0574: yugabyte yugabytedb_managed

Vulnerability summary

CVE-2023-0574 is a critical (CVSS 9.8) vulnerability in yugabyte yugabytedb_managed. EPSS estimates a 0.64% chance of exploitation in the next 30 days, higher than 49.5% of scored vulnerabilities.

Timeline

1. 09-02-2023
   PublishedVulnerability first disclosed.
2. 24-03-2025
   Last modifiedVulnerability information updated.

Description

Server-Side Request Forgery (SSRF), Improperly Controlled Modification of Dynamically-Determined Object Attributes, Improper Restriction of Excessive Authentication Attempts vulnerability in YugaByte, Inc. Yugabyte Managed allows Accessing Functionality Not Properly Constrained by ACLs, Communication Channel Manipulation, Authentication Abuse.This issue affects Yugabyte Managed: from 2.0.0.0 through 2.13.0.0

• CWE-307Improper Restriction of Excessive Authentication AttemptsThe product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.
• CWE-915Improperly Controlled Modification of Dynamically-Determined Object AttributesThe product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.
• CWE-918Server-Side Request Forgery (SSRF)The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.