Skip to content
COOEY

EXPOSURES › CVE-2022-36640

CVE-2022-36640

CRITICAL
DETAIL
SourceNVD · cve Published2022-09-02 CVSS9.8 Referencehttps://nvd.nist.gov/vuln/detail/CVE-2022-36640 ↗
⚡ RCE SHAME 50/100 rce

influxData influxDB before v1.8.10 contains no authentication mechanism or controls, allowing unauthenticated attackers to execute arbitrary commands. NOTE: the CVE ID assignment is disputed because the vendor's documentation states "If InfluxDB is being deployed on a publicly ac

▸ RECOMMENDED ACTION  Remote code execution — patch the affected products on priority.

PLAYERS IMPLICATED
influxdata · vendorinfluxdb · product
DESCRIPTION

influxData influxDB before v1.8.10 contains no authentication mechanism or controls, allowing unauthenticated attackers to execute arbitrary commands. NOTE: the CVE ID assignment is disputed because the vendor's documentation states "If InfluxDB is being deployed on a publicly accessible endpoint, we strongly recommend authentication be enabled. Otherwise the data will be publicly available to any unauthenticated user. The default settings do NOT enable authentication and authorization."

AFFECTED FEDRAMP PRODUCTS · 0
No correlated FedRAMP products.