CVE-2023-29195

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Vitess is a database clustering system for horizontal scaling of MySQL through generalized sharding. Prior to version 16.0.2, users can either intentionally or inadvertently create a shard containing `/` characters from VTAdmin such that from that point on, anyone who tries to create a new shard from VTAdmin will receive an error. Attempting to view the keyspace(s) will also no longer work. Creating a shard using `vtctldclient` does not have the same problem because the CLI validates the input correctly. Version 16.0.2, corresponding to version 0.16.2 of the `go` module, contains a patch for this issue. Some workarounds are available. Always use `vtctldclient` to create shards, instead of using VTAdmin; disable creating shards from VTAdmin using RBAC; and/or delete the topology record for the offending shard using the client for your topology server.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

Affected software

No affected versions have been published.

Timeline

Published
May 11, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-291966.1Discourse is an open source platform for community discussion. This vulnerability is not exploitable on the default install of Discourse. A CVE-2023-291977.5guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Affected versions are subject to improper header parsing. An attackerCVE-2023-291988.5Electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Electron apps using `contexCVE-2023-2919910.0There exists a vulnerability in source code transformer (exception sanitization logic) of vm2 for versions up to 3.9.15, allowing attackers CVE-2023-292006.5Contao is an open source content management system. Prior to versions 4.9.40, 4.13.21, and 5.1.4, logged in users can list arbitrary system CVE-2023-292019.0XWiki Commons are technical libraries common to several other top level XWiki projects. The "restricted" mode of the HTML cleaner in XWiki, CVE-2023-292029.0XWiki Commons are technical libraries common to several other top level XWiki projects. The RSS macro that is bundled in XWiki included the CVE-2023-292035.3XWiki Commons are technical libraries common to several other top level XWiki projects. It's possible to list some users who are normally noCVE-2023-292046.1XWiki Commons are technical libraries common to several other top level XWiki projects. It is possible to bypass the existing security measuCVE-2023-292055.4XWiki Commons are technical libraries common to several other top level XWiki projects. The HTML macro does not systematically perform a proCVE-2023-292065.4XWiki Commons are technical libraries common to several other top level XWiki projects. There was no check in the author of a JavaScript xobCVE-2023-292079.0XWiki Commons are technical libraries common to several other top level XWiki projects. The Livetable Macro wasn't properly sanitizing colum
CVE-2023-29195: Medium severity, CVSS 4.3 | Vulnix