Skip to content
OpenAdvisories
Medium · 5.3 CVE-2023-6001 EUVD-2023-58268GHSA-jj53-4h2j-9gmj

Prometheus Metrics Accessible Pre-Authentication

Published Nov 7, 2023 · Updated Sep 17, 2024 · Assigned by Yugabyte

Vendor: YugabyteDB Product: YugabyteDB Anywhere

Description

Prometheus metrics are available without
authentication. These expose detailed and sensitive information about the YugabyteDB Anywhere environment.

Affected products

VendorProductAffectedFixed
YugabyteDB YugabyteDB Anywhere 2.0.0.0 – ≤ 2.18.3.0 2.18.4.0

References