Critical severity · published Sep 2, 2022
CVE-2022-36640
influxData influxDB before v1.8.10 contains no authentication mechanism or controls, allowing unauthenticated attackers to execute arbitrary commands
9.8
CVSS
2.6%
EPSS
No
On KEV
Description
influxData influxDB before v1.8.10 contains no authentication mechanism or controls, allowing unauthenticated attackers to execute arbitrary commands. NOTE: the CVE ID assignment is disputed because the vendor's documentation states "If InfluxDB is being deployed on a publicly accessible endpoint, we strongly recommend authentication be enabled. Otherwise the data will be publicly available to any unauthenticated user. The default settings do NOT enable authentication and authorization."
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.6% · higher than 85% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IN
Influxdb · Influxdata
before 1.8.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-36640
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-36640
Broken Link
http://www.krsecu.com/CVE/409b5310045bd6b9a984a5fb63bd8786d5c5681a8ad5b1c815c84b2b90002ad7.docx
Patch
https://dl.influxdata.com/influxdb/releases/influxdb_1.8.10_amd64.deb
Patch
https://portal.influxdata.com/downloads/
Product
https://www.influxdata.com/
More from Influxdb
9.8
CVE-2019-20933
InfluxDB before 1.7.6 has an authentication bypass vulnerability in the authenticate function in services/httpd/handler.go because a JWT token may have an empty SharedSecret (aka…
4.8
CVE-2018-17572
InfluxDB 0.9.5 has Reflected XSS in the Write Data module