CVE-2023-22950

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

An issue was discovered in TigerGraph Enterprise Free Edition 3.x. Data loading jobs in gsql_server, created by any user with designer permissions, can read sensitive data from arbitrary locations.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-669

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://dev.tigergraph.com/forum/c/tg-community/announcements/35Vendor Advisory
https://neo4j.com/security/cve-2023-22950/Exploit, Third Party Advisory
https://dev.tigergraph.com/forum/c/tg-community/announcements/35Vendor Advisory
https://neo4j.com/security/cve-2023-22950/Exploit, Third Party Advisory

Timeline

Published: Apr 13, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-229518.8An issue was discovered in TigerGraph Enterprise Free Edition 3.x. It creates an authentication token for internal systems use. This token c CVE-2023-229528.8In SugarCRM before 12.0. Hotfix 91155, a crafted request can inject custom PHP code through the EmailTemplates because of missing input vali CVE-2023-229538.8In ExpressionEngine before 7.2.6, remote code execution can be achieved by an authenticated Control Panel user.CVE-2023-229557.8An issue was discovered on AudioCodes VoIP desk phones through 3.4.4.1000. The validation of firmware images only consists of simple checksu CVE-2023-229567.5An issue was discovered on AudioCodes VoIP desk phones through 3.4.4.1000. Due to the use of a hard-coded cryptographic key, an attacker is CVE-2023-229577.5An issue was discovered in libac_des3.so on AudioCodes VoIP desk phones through 3.4.4.1000. Due to the use of hard-coded cryptographic key, CVE-2023-229586.1The Syracom Secure Login plugin before 3.1.1.0 for Jira may allow spoofing of 2FA PIN validation via the plugins/servlet/twofactor/public/pi CVE-2023-229598.8WebChess through 0.9.0 and 1.0.0.rc2 allows SQL injection: mainmenu.php, chess.php, and opponentspassword.php (txtFirstName, txtLastName).CVE-2023-22966.1The Loginizer WordPress plugin before 1.7.9 does not escape a parameter before outputting it back in the page, leading to a Reflected Cross-CVE-2023-229607.5Lexmark products through 2023-01-10 have Improper Control of Interaction Frequency.CVE-2023-229635.3The personnummer implementation before 3.0.3 for Dart mishandles numbers in which the last four digits match the ^000[0-9]$ regular expressi CVE-2023-229649.1Zoho ManageEngine ServiceDesk Plus MSP before 10611, and 13x before 13004, is vulnerable to authentication bypass when LDAP authentication i