TI-2023-25223 Aliases CVE-2023-46740 GHSA-4248-p65p-hcrm

Insecure random string generator used for sensitive data

MEDIUM 43CWE-330Published 2024-01-03 · Updated 2025-06-17

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.

Summary

CubeFS is an open-source cloud-native file storage system. Prior to version 3.3.1, CubeFS used an insecure random string generator to generate user-specific, sensitive keys used to authenticate users in a CubeFS deployment. This could allow an attacker to predict and/or guess the generated string and impersonate a user thereby obtaining higher privileges. When CubeFS creates new users, it creates a piece of sensitive information for the user called the “accessKey”. To create the "accesKey", CubeFS uses an insecure string generator which makes it easy to guess and thereby impersonate the created user. An attacker could leverage the predictable random string generator and guess a users access key and impersonate the user to obtain higher privileges. The issue has been fixed in v3.3.1. There is no other mitigation than to upgrade.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00439 38th percentileScored 2026-11-07

Fix Fixed cubefs (cubefs): 3.3.1github.com/cubefs/cubefs (Go): 3.3.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
backstage	cubefs	before 3.3.1	3.3.1	Patch available	CNA
—	github.com/cubefs/cubefs (Go)	before 3.3.1	3.3.1	Patch available	GHSA-4248-p65p-hcrm

cubefs Vendorbackstage Affected before 3.3.1 Fixed in 3.3.1 Patch available CNA
github.com/cubefs/cubefs (Go) Vendor— Affected before 3.3.1 Fixed in 3.3.1 Patch available GHSA-4248-p65p-hcrm

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:linuxfoundation:cubefs::::::::	before 3.3.1	Vulnerable	backstage

cpe:2.3:a:linuxfoundation:cubefs:*:*:*:*:*:*:*:* Versions before 3.3.1 Vulnerable ·backstage

Remediation

Fix · CNA cubefs (cubefs) Fixed in 3.3.1
Fix · GHSA-4248-p65p-hcrm github.com/cubefs/cubefs (Go) Fixed in 3.3.1 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2023-46740
2026-10-03 Alias added: GHSA-4248-p65p-hcrm

References

Patch 1

https://github.com/cubefs/cubefs/commit/8555c6402794cabdf2cc025c8bea1576122c07ba

Advisory 2

Other 1

https://github.com/cubefs/cubefs

TI-2023-25224 CubeFS leaks magic secret key when starting Blobstore access service CVSS 3.1CRITICAL 9.8
TI-2023-25222 Timing attack can leak user passwords CVSS 3.1MEDIUM 6.5
TI-2023-14347 CubeFS through 3.2.1 allows Kubernetes cluster-level privilege escalation. CVSS 3.1MEDIUM 6.5
TI-2023-25221 Authenticated users can crash the CubeFS servers with maliciously crafted requests CVSS 3.1MEDIUM 6.5
TI-2023-25225 CubeFS leaks users key in logs CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences