CVE-2022-36640

influxData influxDB before v1.8.10 contains no authentication mechanism or controls, allowing unauthenticated attackers to execute arbitrary commands. NOTE: the CVE ID assignment is disputed because the vendor's documentation states "If InfluxDB is being deployed on a publicly accessible endpoint, we strongly recommend authentication be enabled. Otherwise the data will be publicly available to any unauthenticated user. The default settings do NOT enable authentication and authorization.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
http://influxdata.com	Product
http://influxdb.com	Product
http://www.krsecu.com/CVE/409b5310045bd6b9a984a5fb63bd8786d5c5681a8ad5b1c815c84b2b90002ad7.docx	Broken Link
https://dl.influxdata.com/influxdb/releases/influxdb_1.8.10_amd64.deb	Patch Vendor Advisory
https://portal.influxdata.com/downloads/	Patch Product
https://www.influxdata.com/	Product

Configurations

Configuration 1 (hide)

cpe:2.3:a:influxdata:influxdb:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2022-09-02 21:15

Updated : 2024-05-17 02:11

NVD link : CVE-2022-36640

Mitre link : CVE-2022-36640

CVE.ORG link : CVE-2022-36640

JSON object : View

Products Affected

influxdata

influxdb

CWE

CWE-276

Incorrect Default Permissions

{"id": "CVE-2022-36640", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2022-09-02T21:15:16.427", "references": [{"url": "http://influxdata.com", "tags": ["Product"], "source": "cve@mitre.org"}, {"url": "http://influxdb.com", "tags": ["Product"], "source": "cve@mitre.org"}, {"url": "http://www.krsecu.com/CVE/409b5310045bd6b9a984a5fb63bd8786d5c5681a8ad5b1c815c84b2b90002ad7.docx", "tags": ["Broken Link"], "source": "cve@mitre.org"}, {"url": "https://dl.influxdata.com/influxdb/releases/influxdb_1.8.10_amd64.deb", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://portal.influxdata.com/downloads/", "tags": ["Patch", "Product"], "source": "cve@mitre.org"}, {"url": "https://www.influxdata.com/", "tags": ["Product"], "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-276"}]}], "descriptions": [{"lang": "en", "value": "influxData influxDB before v1.8.10 contains no authentication mechanism or controls, allowing unauthenticated attackers to execute arbitrary commands. NOTE: the CVE ID assignment is disputed because the vendor's documentation states \"If InfluxDB is being deployed on a publicly accessible endpoint, we strongly recommend authentication be enabled. Otherwise the data will be publicly available to any unauthenticated user. The default settings do NOT enable authentication and authorization."}, {"lang": "es", "value": "influxData influxDB versiones anteriores a v1.8.10, no contiene ning\u00fan mecanismo o control de autenticaci\u00f3n, lo que permite a atacantes no autenticados ejecutar comandos arbitrarios"}], "lastModified": "2024-05-17T02:11:35.953", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:influxdata:influxdb:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9D5EBB78-EEED-4A60-87E0-385BDBE13A57", "versionEndExcluding": "1.8.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}