title: Server-Side Request Forgery
description: Server-Side Request Forgery (SSRF), Improperly Controlled Modification of Dynamically-Determined Object Attributes, Improper Restriction of Excessive Authentication Attempts vulnerability in YugaByte, Inc. Yugabyte Managed allows Accessing Functionality Not Properly Constrained by ACLs, Communication Channel Manipulation, Authentication Abuse.This issue affects Yugabyte Managed: from 2.0.0.0 through 2.13.0.0
problem types: CWE-918 Server-Side Request Forgery (SSRF)
affected:
{
defaultStatus: unaffected
modules: UniverseCRUDHandler.java
platforms: [Linux, Docker, Kubernetes]
product: YugabyteDB Anywhere
vendor: YugabyteDB
versions:
lessThanOrEqual: 2.13.0.0, status: affected, version: 2.0.0.0, versionType: 2.0 to 2.13
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.8
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions: Fixed in version 2.14 onwards .