An issue was discovered in TigerGraph Enterprise Free Edition 3.x. It creates an authentication token for internal systems use. This token can be read from the configuration file. Using this token on the REST API provides an attacker with anonymous admin-level privileges on all REST API endpoints.
References
| Link | Resource |
|---|---|
| https://dev.tigergraph.com/forum/c/tg-community/announcements/35 | Product |
| https://dev.tigergraph.com/forum/c/tg-community/announcements/35 | Product |
| https://neo4j.com/security/cve-2023-22951/ | Exploit Third Party Advisory |
| https://neo4j.com/security/cve-2023-22951/ | Exploit Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
07 Feb 2025, 17:15
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://neo4j.com/security/cve-2023-22951/ - Exploit, Third Party Advisory | |
| References | () https://dev.tigergraph.com/forum/c/tg-community/announcements/35 - Product |
24 Apr 2023, 14:43
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:tigergraph:tigergraph_enterprise:3.7.0:*:*:*:free:-:*:* cpe:2.3:a:tigergraph:cloud:-:*:*:*:*:*:*:* cpe:2.3:a:tigergraph:tigergraph_enterprise:3.7.0:*:*:*:free:docker:*:* |
|
| References | (MISC) https://dev.tigergraph.com/forum/c/tg-community/announcements/35 - Product | |
| References | (MISC) https://neo4j.com/security/cve-2023-22951/ - Exploit, Third Party Advisory | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.8 |
| First Time |
Tigergraph cloud
Tigergraph Tigergraph tigergraph Enterprise |
|
| CWE | NVD-CWE-Other |
13 Apr 2023, 20:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-04-13 20:15
Updated : 2025-02-07 17:15
NVD link : CVE-2023-22951
Mitre link : CVE-2023-22951
JSON object : View
Products Affected
tigergraph
- tigergraph_enterprise
- cloud
CWE