CVE-2023-46742

    Dashboard / Vulnerabilities / CVE-2023-46742

    CVE-2023-46742

    Published: 3 Jan 2024Last Modified: 28 Oct 2026

    Summary: CubeFS leaks users key in logs

    Details: CubeFS is an open-source cloud-native file storage system. CubeFS prior to version 3.3.1 was found to leak users secret keys and access keys in the logs in multiple components. When CubeCS creates new users, it leaks the users secret key. This could allow a lower-privileged user with access to the logs to retrieve sensitive information and impersonate other users with higher privileges than themselves. The issue has been patched in v3.3.1. There is no other mitigation than upgrading CubeFS.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/46xxx/CVE-2023-46742.json, https://github.com/cubefs/cubefs/security/advisories/GHSA-vwch-g97w-hfg2, https://nvd.nist.gov/vuln/detail/CVE-2023-46742, https://github.com/cubefs/cubefs/commit/8dccce6ac8dff3db44d7e9074094c7303a5ff5dd

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -84795afb21a64e92db9e53fb88d33410ac3c49c0

    Affected versions

    v3.3.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-46742 | CVE-DB