Vulnerability Intelligence Report
CVE-2023-22949
An issue was discovered in TigerGraph Enterprise Free Edition 3.x. There is logging of user credentials. All authenticated GSQL access requests are logged by TigerGraph in multiple places. Each request includes both the username and password of the user in an easily decodable base64 form. That could allow a TigerGraph administrator to effectively harvest usernames/passwords.
No Active Exploit Signals
CVSS Base Score
4.9
MEDIUM
Exploitability:1.3
Impact Score:3.6
EPSS Probability:0.42%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-312 ↗CWE-312 Cleartext Storage of Sensitive Information
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| tigergraph | cloud | all |
| tigergraph | tigergraph_enterprise | 3.7.0 |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
0.417%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | MITRE Corporation · N/A · USA |
| Reserved | 2023-01-11T00:00:00 |
| Published | 2023-04-14T00:00:00 |
| Last Updated | 2025-02-07T21:10:03 |
Community Chatter & Buzz