Vulnerabilities

TI-2022-16928 CVE-2022-36640 · GHSA-x7v4-5qjr-j62x

influxData influxDB before v1.8.10 contains no authentication mechanism or controls…

MEDIUM 47

influxData influxDB before v1.8.10 contains no authentication mechanism or controls, allowing unauthenticated attackers to execute arbitrary commands.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02567 Published 2022-09-02 No fix listed CWE-276

TI-2020-17870 CVE-2020-35187 · GHSA-r9v7-wgfw-56p5

The official telegraf docker images before 1.9.4-alpine (Alpine specific) contain a blank…

MEDIUM 46

The official telegraf docker images before 1.9.4-alpine (Alpine specific) contain a blank password for a root user.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02201 Published 2020-12-17 No fix listed CWE-306

TI-2019-15140 CVE-2019-20933 · GHSA-2rmp-fw5r-j5qv

InfluxDB before 1.7.6 has an authentication bypass vulnerability in the authenticate…

HIGH 66

InfluxDB before 1.7.6 has an authentication bypass vulnerability in the authenticate function in services/httpd/handler.go because a JWT token may have an empty SharedSecret (aka shared secret).

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.30921 Published 2020-11-19 Fixed in 1.7.6 CWE-287

TI-2018-12518 CVE-2018-17572 · GHSA-w55x-q3gv-px85

InfluxDB 0.9.5 has Reflected XSS in the Write Data module.

LOW 23

InfluxDB 0.9.5 has Reflected XSS in the Write Data module.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00727 Published 2020-03-02 Fixed in 0.9.6 CWE-79

Vulnerabilities

Filters

influxData influxDB before v1.8.10 contains no authentication mechanism or controls…

The official telegraf docker images before 1.9.4-alpine (Alpine specific) contain a blank…

InfluxDB before 1.7.6 has an authentication bypass vulnerability in the authenticate…

InfluxDB 0.9.5 has Reflected XSS in the Write Data module.