CVE-2022-37397
The software is vulnerable when using LDAP-based authentication in YCQL with Microsoft’s Active Directory
Summary
The software is vulnerable when using LDAP-based authentication in YCQL with Microsoft’s Active Directory
Original description
The description as published by the source.
An issue was discovered in the YugabyteDB 2.6.1 when using LDAP-based authentication in YCQL with Microsoft’s Active Directory. When anonymous or unauthenticated LDAP binding is enabled, it allows bypass of authentication with an empty password.
References
- advisory github.com
- advisory nvd.nist.gov
- web yugabyte.com