title: Log Injection
description: YugabyteDB is vulnerable to cross site scripting (XSS) via log injection. Writing invalidated user input to log files can allow an unprivileged attacker to forge log entries or inject malicious content into the logs.
problem types: CWE-117: Improper Output Neutralization for Logs
affected:
{
defaultStatus: unaffected
platforms: [Linux, Docker, Kubernetes, MacOS]
product: YugabyteDB
vendor: YugabyteDB
versions:
lessThanOrEqual: 2.14.13.0, 2.16.7.0, 2.18.3.0, status: affected, version: 2.0.0.0, versionType: semver
status: unaffected, version: 2.14.14.0
status: unaffected, version: 2.16.8.0
status: unaffected, version: 2.18.4.0
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL