title: Set Logging Level Without Authentication
description: The controller responsible for setting the logging level does not include any authorization
checks to ensure the user is authenticated. This can be seen by noting that it extends
Controller rather than AuthenticatedController and includes no further checks. This issue affects YugabyteDB Anywhere: from 2.0.0 through 2.17.3
problem types: CWE-284 Improper Access Control
affected:
{
defaultStatus: unaffected
product: Anywhere
repo: https://github.com/yugabyte/yugabyte-db
vendor: YugabyteDB
versions:
lessThanOrEqual: 2.17.3, status: affected, version: 2.0.0, versionType: 2.17.3.0
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL