GCVE - cpe:2.3:a:yugabyte:yugabytedb:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:yugabyte:yugabytedb:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Yugabyte (`b24c7799-e269-5385-88de-d4fde6d36113`)
Product	Yugabytedb (`c1fb7f7b-dba2-5136-923f-d6cebe823be5`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:docker/yugabytedb/yugabyte`	purl2cpe	2026-06-01 10:15:44.256031
`pkg:github/yugabyte/yugabyte-db`	purl2cpe	2026-06-01 10:15:44.256033
`pkg:sourceforge/yugabytedb.mirror`	purl2cpe	2026-06-01 10:15:44.256034

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2024-6895`	vulnerable	2026-06-08 06:58:20.675903	Insecure Account Profile Management Insufficient authentication in user account management in Yugabyte Platform allows local network attackers with a compromised user session to change critical security information without re-authentication. An attacker with user session and access to application can modify settings such as password and email without being prompted for the current password, enabling account takeover. Published: 2024-07-19T14:47:50.432Z Updated: 2024-08-13T20:45:30.139Z Open on db.gcve.eu Reference links https://github.com/yugabyte/yugabyte-db/commit/9687371d8777f876285b737a9d01995bc46bafa5	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-6002`	vulnerable	2026-06-08 06:19:45.381877	Log Injection MEDIUM (6.5) YugabyteDB is vulnerable to cross site scripting (XSS) via log injection. Writing invalidated user input to log files can allow an unprivileged attacker to forge log entries or inject malicious content into the logs. Published: 2023-11-07T23:56:50.729Z Updated: 2024-09-17T13:03:18.141Z Open on db.gcve.eu Reference links https://www.yugabyte.com/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-6001`	vulnerable	2026-06-08 06:19:45.380120	Prometheus Metrics Accessible Pre-Authentication MEDIUM (5.3) Prometheus metrics are available without authentication. These expose detailed and sensitive information about the YugabyteDB Anywhere environment. Published: 2023-11-07T23:25:16.135Z Updated: 2024-09-17T13:03:52.610Z Open on db.gcve.eu Reference links https://www.yugabyte.com/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-4640`	vulnerable	2026-06-08 06:16:14.050384	Set Logging Level Without Authentication MEDIUM (6.5) The controller responsible for setting the logging level does not include any authorization checks to ensure the user is authenticated. This can be seen by noting that it extends Controller rather than AuthenticatedController and includes no further checks. This issue affects YugabyteDB Anywhere: from 2.0.0 through 2.17.3 Published: 2023-08-30T16:42:45.242Z Updated: 2024-10-01T18:31:56.957Z Open on db.gcve.eu Reference links https://www.yugabyte.com/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-0575`	vulnerable	2026-06-08 05:52:31.948958	Remote Code Execution HIGH (7.2) External Control of Critical State Data, Improper Control of Generation of Code ('Code Injection') vulnerability in YugaByte, Inc. Yugabyte DB on Windows, Linux, MacOS, iOS (DevopsBase.Java:execCommand, TableManager.Java:runCommand modules) allows API Manipulation, Privilege Abuse. This vulnerability is associated with program files backup.Py. This issue affects Yugabyte DB: Lesser then 2.2.0.0 Published: 2023-02-09T16:12:46.327Z Updated: 2025-03-24T18:34:16.202Z Open on db.gcve.eu Reference links https://www.yugabyte.com/	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.