CVE-2023-6001

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Prometheus metrics are available without authentication. These expose detailed and sensitive information about the YugabyteDB Anywhere environment.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200CWE-862

Affected software

VendorProductVersions
YugabyteDBYugabyteDB Anywhere>= 2.0.0.0, <= 2.18.3.0

References

Timeline

Published
Nov 8, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-60026.1YugabyteDB is vulnerable to cross site scripting (XSS) via log injection. Writing invalidated user input to log files can allow an unprivileCVE-2023-60044.8A flaw was found in libssh. By utilizing the ProxyCommand or ProxyJump feature, users can exploit unchecked hostname syntax on the client. TCVE-2023-60054.8The EventON WordPress plugin before 4.5.5, EventON WordPress plugin before 2.2.7 does not sanitize and escape some of its settings, which coCVE-2023-60066.7This vulnerability potentially allows local attackers to escalate privileges on affected installations of PaperCut NG. An attacker must haveCVE-2023-60076.5The UserPro plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data due to a missing capabilitCVE-2023-60084.3The UserPro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.1.1. This is due to missingCVE-2023-60098.8The UserPro plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.1.4 due to insufficient restrictiCVE-2023-60115.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DECE Software Geodi allows Stored XSS.CVE-2023-60129.8An improper input validation vulnerability has been found in Lanaccess ONSAFE MonitorHM affecting version 3.7.0. This vulnerability could leCVE-2023-60135.4H2O is vulnerable to stored XSS vulnerability which can lead to a Local File Include attack.CVE-2023-60149.8An attacker is able to arbitrarily create an account in MLflow bypassing any authentication requirment.CVE-2023-60157.5MLflow allowed arbitrary files to be PUT onto the server.
CVE-2023-6001: High severity, CVSS 7.5 | Vulnix