CVE-2019-20933

Description

InfluxDB before 1.7.6 has an authentication bypass vulnerability in the authenticate function in services/httpd/handler.go because a JWT token may have an empty SharedSecret (aka shared secret).

Risk Information

Base Score

9.8

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score

Exploitation Probability

93.968

Associated Vulnerability

Vulnerability	OS Platform
influxdb security update(DSA-4823-1) influxdb_1.6.4-1+deb10u1_i386.deb	Linux
influxdb security update(DSA-4823-1) influxdb_1.6.4-1+deb10u1_amd64.deb	Linux
Scalable datastore for metrics, events, and real-time analytics (USN-5451-1) influxdb_1.1.1+dfsg1-4+deb9u1ubuntu1_i386.deb	Linux
Scalable datastore for metrics, events, and real-time analytics (USN-5451-1) influxdb_1.1.1+dfsg1-4+deb9u1ubuntu1_amd64.deb	Linux
Scalable datastore for metrics, events, and real-time analytics (USN-5451-1) influxdb_1.6.4-1+deb10u1ubuntu0.2_amd64.deb	Linux
Scalable datastore for metrics, events, and real-time analytics (USN-5451-1) influxdb_1.6.4-1+deb10u1build0.20.04.1_amd64.deb	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234