Vendors / Influxdata Records 4 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 3
CVSS high 0
Exploited now Influxdata records in CISA KEV No Influxdata vulnerabilities are listed in CISA KEV.
Components Products in the NVD configurations · select one to filter the records Priority HIGH 66
InfluxDB before 1.7.6 has an authentication bypass vulnerability in the authenticate function in services/httpd/handler.go because a JWT token may have an empty SharedSecret (aka shared secret).
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.30921 · Published 2020-11-19 · Fixed in 1.7.6 CWE-287
Priority MEDIUM 47
influxData influxDB before v1.8.10 contains no authentication mechanism or controls, allowing unauthenticated attackers to execute arbitrary commands.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02567 · Published 2022-09-02 · No fix listed CWE-276
Priority MEDIUM 46
The official telegraf docker images before 1.9.4-alpine (Alpine specific) contain a blank password for a root user.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02201 · Published 2020-12-17 · No fix listed CWE-306
Priority LOW 23
InfluxDB 0.9.5 has Reflected XSS in the Write Data module.
CVSS 3.1 MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.00727 · Published 2020-03-02 · Fixed in 0.9.6 CWE-79
Open these records in search → All records by CVSS severity
3 0 1 0 0
