An issue was discovered in Tigergraph Enterprise 3.7.0. The TigerGraph platform allows users to define new User Defined Functions (UDFs) from C/C++ code. To support this functionality TigerGraph allows users to upload custom C/C++ code which is then compiled and installed into the platform. An attacker who has filesystem access on a remote TigerGraph system can alter the behavior of the database against the will of the database administrator; thus effectively bypassing the built in RBAC controls.
References
Link | Resource |
---|---|
https://neo4j.com/security/cve-2023-28480/ | Exploit Third Party Advisory |
Configurations
History
18 Aug 2023, 20:22
Type | Values Removed | Values Added |
---|---|---|
CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.5 |
First Time |
Tigergraph
Tigergraph tigergraph |
|
CWE | CWE-434 | |
CPE | cpe:2.3:a:tigergraph:tigergraph:3.7.0:*:*:*:enterprise:*:*:* | |
References | (MISC) https://neo4j.com/security/cve-2023-28480/ - Exploit, Third Party Advisory |
14 Aug 2023, 19:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2023-08-14 19:15
Updated : 2024-02-28 20:33
NVD link : CVE-2023-28480
Mitre link : CVE-2023-28480
CVE.ORG link : CVE-2023-28480
JSON object : View
Products Affected
tigergraph
- tigergraph
CWE
CWE-434
Unrestricted Upload of File with Dangerous Type