{"schemaVersion":3,"id":"CVE-2023-0574","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Server-Side Request Forgery (SSRF), Improperly Controlled Modification of Dynamically-Determined Object Attributes, Improper Restriction of Excessive Authentication Attempts vulnerability in YugaByte, Inc. Yugabyte Managed allows Accessing Functionality Not Properly Constrained by ACLs, Communication Channel Manipulation, Authentication Abuse.This issue affects Yugabyte Managed: from 2.0.0.0 through 2.13.0.0","dates":{"published":"2023-02-09T14:55:29.165Z","modified":"2025-03-24T18:33:02.110Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":9.8,"severity":"critical","version":"3.1","versionLabel":"v3.1","source":"NVD","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":6.8,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":9.8,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00637,"percentile":0.49606,"severity":"low","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-20T00:00:00.000Z","baselineScore":0.00637},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00637,"percentile":0.49606}],"last30":[{"date":"2026-09-20T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00637,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00637,"percentile":0.49606}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-307","name":"Improper Restriction of Excessive Authentication Attempts","description":"The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.","type":"weakness","status":"Draft","abstraction":"Base","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/307.html"},{"id":"CWE-915","name":"Improperly Controlled Modification of Dynamically-Determined Object Attributes","description":"The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.","type":"weakness","status":"Incomplete","abstraction":"Base","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/915.html"},{"id":"CWE-918","name":"Server-Side Request Forgery (SSRF)","description":"The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.","type":"weakness","status":"Incomplete","abstraction":"Base","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/918.html"}],"affected":[{"vendor":"yugabyte","product":"yugabytedb_managed","name":"yugabytedb managed","label":"yugabytedb_managed","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 2.0, ≤ 2.13","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 2.0, ≤ 2.13","eol":null,"hubHref":"/vendor/yugabyte/yugabytedb_managed"},{"vendor":"yugabytedb","product":"yugabytedb anywhere","name":"YugabyteDB Anywhere","label":"yugabytedb anywhere","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 2.0.0.0, ≤ 2.13.0.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 2.0.0.0, ≤ 2.13.0.0","eol":null,"hubHref":"/vendor/yugabytedb/yugabytedb_anywhere"}],"affectedCount":2,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://www.yugabyte.com/","label":"www.yugabyte.com","hostname":"www.yugabyte.com","tags":["Product"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2023-02-09T14:55:29.165Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2025-03-24T18:33:02.110Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":70,"level":"high","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T16:56:00.017Z","stale":false,"partial":false}}