CVE-2022-36640

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-36640
influxData influxDB before v1.8.10 contains no authentication mechanism or controls, allowing unauthenticated attackers to execute arbitrary commands. NOTE: the CVE ID assignment is disputed because the vendor's documentation states "If InfluxDB is being deployed on a publicly accessible endpoint, we strongly recommend authentication be enabled. Otherwise the data will be publicly available to any unauthenticated user. The default settings do NOT enable authentication and authorization.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
http://influxdata.com Product
http://influxdb.com Product
http://www.krsecu.com/CVE/409b5310045bd6b9a984a5fb63bd8786d5c5681a8ad5b1c815c84b2b90002ad7.docx Broken Link
https://dl.influxdata.com/influxdb/releases/influxdb_1.8.10_amd64.deb Patch Vendor Advisory
https://portal.influxdata.com/downloads/ Patch Product
https://www.influxdata.com/ Product
http://influxdata.com Product
http://influxdb.com Product
http://www.krsecu.com/CVE/409b5310045bd6b9a984a5fb63bd8786d5c5681a8ad5b1c815c84b2b90002ad7.docx Broken Link
https://dl.influxdata.com/influxdb/releases/influxdb_1.8.10_amd64.deb Patch Vendor Advisory
https://portal.influxdata.com/downloads/ Patch Product
https://www.influxdata.com/ Product
Configurations

Configuration 1 (hide)

cpe:2.3:a:influxdata:influxdb:*:*:*:*:*:*:*:*
History

21 Nov 2024, 07:13

Type Values Removed Values Added
References () http://influxdata.com - Product () http://influxdata.com - Product
References () http://influxdb.com - Product () http://influxdb.com - Product
References () http://www.krsecu.com/CVE/409b5310045bd6b9a984a5fb63bd8786d5c5681a8ad5b1c815c84b2b90002ad7.docx - Broken Link () http://www.krsecu.com/CVE/409b5310045bd6b9a984a5fb63bd8786d5c5681a8ad5b1c815c84b2b90002ad7.docx - Broken Link
References () https://dl.influxdata.com/influxdb/releases/influxdb_1.8.10_amd64.deb - Patch, Vendor Advisory () https://dl.influxdata.com/influxdb/releases/influxdb_1.8.10_amd64.deb - Patch, Vendor Advisory
References () https://portal.influxdata.com/downloads/ - Patch, Product () https://portal.influxdata.com/downloads/ - Patch, Product
References () https://www.influxdata.com/ - Product () https://www.influxdata.com/ - Product

07 Nov 2023, 03:49

Type Values Removed Values Added
Summary ** DISPUTED ** influxData influxDB before v1.8.10 contains no authentication mechanism or controls, allowing unauthenticated attackers to execute arbitrary commands. NOTE: the CVE ID assignment is disputed because the vendor's documentation states "If InfluxDB is being deployed on a publicly accessible endpoint, we strongly recommend authentication be enabled. Otherwise the data will be publicly available to any unauthenticated user. The default settings do NOT enable authentication and authorization." influxData influxDB before v1.8.10 contains no authentication mechanism or controls, allowing unauthenticated attackers to execute arbitrary commands. NOTE: the CVE ID assignment is disputed because the vendor's documentation states "If InfluxDB is being deployed on a publicly accessible endpoint, we strongly recommend authentication be enabled. Otherwise the data will be publicly available to any unauthenticated user. The default settings do NOT enable authentication and authorization.
Information

Published : 2022-09-02 21:15

Updated : 2024-11-21 07:13

NVD link : CVE-2022-36640

Mitre link : CVE-2022-36640

CVE.ORG link : CVE-2022-36640

JSON object : View

Products Affected

influxdata

  • influxdb
CWE
CWE-276

Incorrect Default Permissions