CVE-2023-4640
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
The controller responsible for setting the logging level does not include any authorization checks, allowing unauthorized users to access it. This issue affects YugabyteDB Anywhere from versions 2.0.0 to 2.17.3.
Risk Assessment
The lack of authorization when setting the logging level may lead to the exposure of sensitive information or manipulation of logs by unauthorized users.
Recommendation
It is recommended to implement appropriate authorization checks in the logging level controller to ensure that only authenticated users have access to it.
Original NVD description (English source)
The controller responsible for setting the logging level does not include any authorization checks to ensure the user is authenticated. This can be seen by noting that it extends Controller rather than AuthenticatedController and includes no further checks. This issue affects YugabyteDB Anywhere: from 2.0.0 through 2.17.3