Vulnerability Details : CVE-2023-22948
Potential exploit
An issue was discovered in TigerGraph Enterprise Free Edition 3.x. There is unsecured read access to an SSH private key. Any code that runs as the tigergraph user is able to read the SSH private key. With this, an attacker is granted password-less SSH access to all machines in the TigerGraph cluster.
Products affected by CVE-2023-22948
- Tigergraph » Tigergraph » Cloud EditionVersions from including (>=) 3.0 and up to, including, (<=) 3.7.0cpe:2.3:a:tigergraph:tigergraph:*:*:*:*:cloud:*:*:*
- Tigergraph » Tigergraph » Enterprise Free EditionVersions from including (>=) 3.0 and up to, including, (<=) 3.7.0cpe:2.3:a:tigergraph:tigergraph:*:*:*:*:enterprise_free:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2023-22948
0.07%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 18 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2023-22948
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
4.9
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N |
1.2
|
3.6
|
134c704f-9b21-4f2e-91b3-4a467353bcc0 | 2025-02-07 |
|
4.9
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N |
1.2
|
3.6
|
NIST |
CWE ids for CVE-2023-22948
-
The product does not encrypt sensitive or critical information before storage or transmission.Assigned by:
- 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)
- nvd@nist.gov (Primary)
References for CVE-2023-22948
-
https://dev.tigergraph.com/forum/c/tg-community/announcements/35
Latest TigerGraph Community/Announcements topics - TigerGraphVendor Advisory
-
https://neo4j.com/security/cve-2023-22948/
Unsecured SSH Credentials - Neo4j Graph Data PlatformExploit;Third Party Advisory
Jump to