CVE-2022-37397

An issue was discovered in the YugabyteDB 2.6.1 when using LDAP-based authentication in YCQL with Microsoft’s Active Directory. When anonymous or unauthenticated LDAP binding is enabled, it allows bypass of authentication with an empty password.

Score

CVSS 3.1 9.8 Critical

Status

Modified - security@yugabyte.com

Published

2022-08-12

Last modified

2024-08-03

Weaknesses

CWE-16, CWE-287

Affected products

• Yugabytedb (Yugabyte)
• Yugabyte Db (Yugabyte Inc.)

References

• https://www.yugabyte.com/