CVE-2023-6002CWE-117

Log Injection

Medium · published November 7, 2023

CVSS v3.1
6.5
EPSS
0%
Percentile
33.7
In the wild
Unconfirmed
What it is

YugabyteDB is vulnerable to cross site scripting (XSS) via log injection. Writing invalidated user input to log files can allow an unprivileged attacker to forge log entries or inject malicious content into the logs.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00405 · 33.7th percentile
Weakness
CWE-117 · Improper Output Neutralization for Logs
Published
2023-11-07T23:56Z
EPSS history
Timeline
  • 07 NOV 23:56Z
    Log Injection
    cvelistv5