CVE-2023-46255

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

SpiceDB is an open source, Google Zanzibar-inspired database for creating and managing security-critical application permissions. Prior to version 1.27.0-rc1, when the provided datastore URI is malformed (e.g. by having a password which contains `:`) the full URI (including the provided password) is printed, so that the password is shown in the logs. Version 1.27.0-rc1 patches this issue.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-532

Affected software

No affected versions have been published.

Timeline

Published: Oct 31, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-462569.8PX4-Autopilot provides PX4 flight control solution for drones. In versions 1.14.0-rc1 and prior, PX4-Autopilot has a heap buffer overflow vu CVE-2023-462579.8An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of CVE-2023-462589.8An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of CVE-2023-462599.8An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of CVE-2023-46264.3The LadiApp plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ladiflow_save_h CVE-2023-462609.8An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of CVE-2023-462619.8An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of CVE-2023-462627.5An unauthenticated attacked could send a specifically crafted web request causing a Server-Side Request Forgery (SSRF) in Ivanti Avalanche R CVE-2023-462639.8An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.4.1 and below that could allow an attacker t CVE-2023-462649.8An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.4.1 and below that could allow an attacker t CVE-2023-462659.8An unauthenticated could abuse a XXE vulnerability in the Smart Device Server to leak data or perform a Server-Side Request Forgery (SSRF).CVE-2023-462669.1An attacker can send a specially crafted request which could lead to leakage of sensitive data or potentially a resource-based DoS attack.