CVEvulnerability

CVE-2023-22951

8.8 HIGH Published 2023-04-13 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2023-04-13
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-276

Description

An issue was discovered in TigerGraph Enterprise Free Edition 3.x. It creates an authentication token for internal systems use. This token can be read from the configuration file. Using this token on the REST API provides an attacker with anonymous admin-level privileges on all REST API endpoints.

Affected configurations

• tigergraph cloud • tigergraph tigergraph enterprise 3.7.0

Related

Weakness · CWE (1)

  • CWE-276 Incorrect Default Permissions weakness

References