VULNERABILITY INTELLIGENCE

CVE-2023-6002

CVSS score6.5 MEDIUM
EPSS probability0.40%
CISA KEVNot currently listed
Published2023-11-08
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Description

YugabyteDB is vulnerable to cross site scripting (XSS) via log injection. Writing invalidated user input to log files can allow an unprivileged attacker to forge log entries or inject malicious content into the logs.

Weakness classification

  • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
  • CWE-117: Improper Output Neutralization for Logs

Primary references