CVE-2023-6002

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "https://www.yugabyte.com/", "name": "https://www.yugabyte.com/", "tags": ["Product"], "refsource": ""}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "YugabyteDB is vulnerable to cross site scripting (XSS) via log injection.\u00a0Writing invalidated user input to log files can allow an unprivileged\u00a0attacker to forge log entries or inject malicious content into the logs.\n"}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-79"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2023-6002", "ASSIGNER": "security@yugabyte.com"}}, "impact": {"baseMetricV3": {"cvssV3": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}}, "publishedDate": "2023-11-08T00:15Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:yugabyte:yugabytedb:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "2.18.4.0", "versionStartIncluding": "2.18.0.0"}, {"cpe23Uri": "cpe:2.3:a:yugabyte:yugabytedb:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "2.16.8.0", "versionStartIncluding": "2.16.0.0"}, {"cpe23Uri": "cpe:2.3:a:yugabyte:yugabytedb:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "2.14.14.0", "versionStartIncluding": "2.14.0.0"}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2023-11-15T15:16Z"}