{"id":"CVE-2024-0006","state":"PUBLISHED","title":"DB User Password Leak in Application Log","description":"Information exposure in the logging system in Yugabyte Platform allows local attackers with access to application logs to obtain database user credentials in log files, potentially leading to unauthorized database access.","publishedAt":"2024-07-19T14:26:14.160Z","updatedAt":"2024-08-01T17:41:15.316Z","severity":{"score":5.4,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:A/AC:H/AT:N/PR:H/UI:A/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L","source":"Yugabyte"},"assigner":"Yugabyte","products":["YugabyteDB YugabyteDB Anywhere"],"affected":[{"vendor":"YugabyteDB","product":"YugabyteDB Anywhere","defaultStatus":"unaffected","versions":[{"version":"2.18.0.0","status":"affected","lessThan":"2.18.9.0","versionType":"git"},{"version":"2.20.0.0","status":"affected","lessThan":"2.20.2.3","versionType":"git"},{"version":"2024.0.0.0","status":"affected","lessThan":"2024.1.1.0","versionType":"git"}],"platforms":["Linux","Docker","Kubernetes"]}],"references":["https://github.com/yugabyte/yugabyte-db/commit/439c6286f1971f9ac6bff2c7215b454c2025c593","https://github.com/yugabyte/yugabyte-db/commit/d96e6b629f34d065b47204daeeb44064e484c579","https://github.com/yugabyte/yugabyte-db/commit/5cc7f4e15d6ccccbf97c57946fd0aa630f88c9e2"],"weaknesses":["CWE-532"],"ingestedAt":"2026-10-29T20:06:42.242Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/0xxx/CVE-2024-0006.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-0006","state":"PUBLISHED","datePublished":"2024-07-19T14:26:14.160Z","dateUpdated":"2024-08-01T17:41:15.316Z","assignerShortName":"Yugabyte","assignerOrgId":"d4ae51d3-4db5-465e-bc8a-eb6768324078","dateReserved":"2023-11-07T22:19:42.717Z"},"containers":{"cna":{"title":"DB User Password Leak in Application Log","descriptions":[{"lang":"en","value":"Information exposure in the logging system in Yugabyte Platform allows local attackers with access to application logs to obtain database user credentials in log files, potentially leading to unauthorized database access."}],"affected":[{"vendor":"YugabyteDB","product":"YugabyteDB Anywhere","defaultStatus":"unaffected","versions":[{"version":"2.18.0.0","status":"affected","lessThan":"2.18.9.0","versionType":"git"},{"version":"2.20.0.0","status":"affected","lessThan":"2.20.2.3","versionType":"git"},{"version":"2024.0.0.0","status":"affected","lessThan":"2024.1.1.0","versionType":"git"}],"platforms":["Linux","Docker","Kubernetes"]}],"references":[{"url":"https://github.com/yugabyte/yugabyte-db/commit/439c6286f1971f9ac6bff2c7215b454c2025c593","tags":["patch"]},{"url":"https://github.com/yugabyte/yugabyte-db/commit/d96e6b629f34d065b47204daeeb44064e484c579","tags":["patch"]},{"url":"https://github.com/yugabyte/yugabyte-db/commit/5cc7f4e15d6ccccbf97c57946fd0aa630f88c9e2","tags":["patch"]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"NONE","attackVector":"ADJACENT","baseScore":5.4,"baseSeverity":"MEDIUM","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"LOW","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:H/AT:N/PR:H/UI:A/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-532","description":"CWE-532 Insertion of Sensitive Information into Log File","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"Yugabyte","orgId":"d4ae51d3-4db5-465e-bc8a-eb6768324078","dateUpdated":"2024-07-19T14:26:14.160Z"},"datePublic":"2024-07-18T19:42:00.000Z","impacts":[{"capecId":"CAPEC-560","descriptions":[{"lang":"en","value":"CAPEC-560 Use of Known Domain Credentials"}]}],"source":{"defect":["PLAT-14286"],"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","affected":[{"vendor":"yugabyte","product":"yugabytedb","defaultStatus":"unknown","versions":[{"version":"2.18.0.0","status":"affected","lessThan":"2.18.9.0","versionType":"custom"},{"version":"2.20.0.0","status":"affected","lessThan":"2.20.2.3","versionType":"custom"},{"version":"2024.0.0.0","status":"affected","lessThan":"2024.1.1.0","versionType":"custom"}],"cpes":["cpe:2.3:a:yugabyte:yugabytedb:2.18.0.0:*:*:*:*:*:*:*"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-07-23T14:31:12.448030Z","id":"CVE-2024-0006","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-07-23T14:32:54.285Z"}},{"title":"CVE Program Container","references":[{"url":"https://github.com/yugabyte/yugabyte-db/commit/439c6286f1971f9ac6bff2c7215b454c2025c593","tags":["patch","x_transferred"]},{"url":"https://github.com/yugabyte/yugabyte-db/commit/d96e6b629f34d065b47204daeeb44064e484c579","tags":["patch","x_transferred"]},{"url":"https://github.com/yugabyte/yugabyte-db/commit/5cc7f4e15d6ccccbf97c57946fd0aa630f88c9e2","tags":["patch","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-01T17:41:15.316Z"}}]}}}