CVE-2023-38502

Published Jul 25, 2023

Last updated 2 years ago

CVSS medium 6.5

Overview

Description: TDengine is an open source, time-series database optimized for Internet of Things devices. Prior to version 3.0.7.1, TDengine DataBase crashes on UDF nested query. This issue affects TDengine Databases which let users connect and run arbitrary queries. Version 3.0.7.1 has a patch for this issue.
Source: security-advisories@github.com
NVD status: Analyzed

Risk scores

CVSS 3.1

Type: Primary
Base score: 6.5
Impact score: 3.6
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Severity: MEDIUM

Weaknesses

nvd@nist.gov: NVD-CWE-noinfo
security-advisories@github.com: CWE-20

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:tdengine:tdengine:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "EB09CAA7-D796-44A9-AC5F-F3FCAE76C4DC",
            "versionEndExcluding": "3.0.7.1"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References