CVE-2024-11193: Medium severity Yugabyte YugabyteDB Anywhere vulnerability
An information disclosure vulnerability exists in Yugabyte Anywhere, where the LDAP bind password is logged in plaintext within application logs. This flaw results in the unintentional exposure of sensitive information in Yugabyte Anywhere logs, potentially allowing unauthorized users with access to these logs to view the LDAP bind password. An attacker with log access could exploit this vulnerability to gain unauthorized access to the LDAP server, leading to potential exposure or compromise of LDAP-managed resources This issue affects YugabyteDB Anywhere: from 2.20.0.0 before 2.20.7.0, from 2.23.0.0 before 2.23.1.0, from 2024.1.0.0 before 2024.1.3.0.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-11193?
CVE-2024-11193 is classified as an information disclosure vulnerability, which can lead to the exposure of sensitive information.
How do I fix CVE-2024-11193?
To address CVE-2024-11193, ensure you update to a patched version of YugabyteDB Anywhere that secures log management and does not log sensitive information.
What does CVE-2024-11193 affect?
CVE-2024-11193 affects YugabyteDB Anywhere versions from 2.20.0.0 to 2.20.7.0 and 2.23.0.0 to 2.23.1.0, as well as versions from 2024.1.0.0 to 2024.1.3.0.
What type of information is exposed in CVE-2024-11193?
CVE-2024-11193 allows for the exposure of the LDAP bind password in plaintext within application logs.
Who is at risk from CVE-2024-11193?
Unauthorized users with access to the application logs may exploit CVE-2024-11193 to gain access to sensitive LDAP credentials.