CVE-2023-46739

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

CubeFS is an open-source cloud-native file storage system. A vulnerability was found during in the CubeFS master component in versions prior to 3.3.1 that could allow an untrusted attacker to steal user passwords by carrying out a timing attack. The root case of the vulnerability was that CubeFS used raw string comparison of passwords. The vulnerable part of CubeFS was the UserService of the master component. The UserService gets instantiated when starting the server of the master component. The issue has been patched in v3.3.1. For impacted users, there is no other way to mitigate the issue besides upgrading.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-203

Affected software

No affected versions have been published.

Timeline

Published: Jan 3, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-4674Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Yaztek Software Technologies and Compu CVE-2023-467409.8CubeFS is an open-source cloud-native file storage system. Prior to version 3.3.1, CubeFS used an insecure random string generator to genera CVE-2023-467419.8CubeFS is an open-source cloud-native file storage system. A vulnerability was found in CubeFS prior to version 3.3.1 that could allow users CVE-2023-467426.5CubeFS is an open-source cloud-native file storage system. CubeFS prior to version 3.3.1 was found to leak users secret keys and access keys CVE-2023-467434.3application-collabora is an integration of Collabora Online in XWiki. As part of the application use cases, depending on the rights that a u CVE-2023-467445.4Squidex is an open source headless CMS and content management hub. In affected versions a stored Cross-Site Scripting (XSS) vulnerability en CVE-2023-467457.5LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring which includes support for a wide range of network hardware and oper CVE-2023-467464.3PostHog provides open-source product analytics, session recording, feature flagging and A/B testing that you can self-host. A server-side re CVE-2023-467479.8Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BIG-IP system through CVE-2023-467488.8An authenticated SQL injection vulnerability exists in the BIG-IP Configuration utility which may allow an authenticated attacker with net CVE-2023-467496.5Apache Shiro before 1.13.0 or 2.0.0-alpha-4, may be susceptible to a path traversal attack that results in an authentication bypass when use CVE-2023-46759.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in GM Information Technologies MDO allows