PT-2022-23972 · Microsoft+1 · Active Directory+1
CVE-2022-37397
·
Published
2022-08-12
·
Updated
2022-08-16
CVSS v3.1
8.3
High
| Vector | AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L |
Name of the Vulnerable Software and Affected Versions
YugabyteDB version 2.6.1
Description
An issue was discovered when using LDAP-based authentication in YCQL with Microsoft’s Active Directory. If anonymous or unauthenticated LDAP binding is enabled, it allows bypass of authentication with an empty password.
Recommendations
For YugabyteDB version 2.6.1, consider disabling anonymous or unauthenticated LDAP binding to prevent authentication bypass. As a temporary workaround, restrict access to the LDAP authentication module until a patch is available.
Exploit
Fix
Improper Authentication
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Active Directory
Yugabytedb