Skip to content
CVE PROGRAM SOURCE RECORD8.3 High

CVE-2022-37397

The software is vulnerable when using LDAP-based authentication in YCQL with Microsoft’s Active Directory

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Yugabyte

Description

An issue was discovered in the YugabyteDB 2.6.1 when using LDAP-based authentication in YCQL with Microsoft’s Active Directory. When anonymous or unauthenticated LDAP binding is enabled, it allows bypass of authentication with an empty password.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

YugaByte, Inc. Yugabyte DB

  • 2.6.1.0affected

References