EventStore EventStoreDB credentials storage

Summaryinfo

A vulnerability, which was classified as problematic, was found in EventStore EventStoreDB. Impacted is an unknown function. The manipulation results in credentials storage. This vulnerability is cataloged as CVE-2024-26133. The attack may be launched remotely. There is no exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, was found in EventStore EventStoreDB (affected version not known). Affected is some unknown functionality. The manipulation with an unknown input leads to a credentials storage vulnerability. CWE is classifying the issue as CWE-256. Storing a password in plaintext may result in a system compromise. This is going to have an impact on confidentiality. CVE summarizes:

EventStoreDB (ESDB) is an operational database built to store events. A vulnerability has been identified in the projections subsystem in versions 20 prior to 20.10.6, 21 prior to 21.10.11, 22 prior to 22.10.5, and 23 prior to 23.10.1. Only database instances that use custom projections are affected by this vulnerability. User passwords may become accessible to those who have access to the chunk files on disk, and users who have read access to system streams. Only users in the `$admins` group can access system streams by default. ESDB 23.10.1, 22.10.5, 21.10.11, and 20.10.6 contain a patch for this issue. Users should upgrade EventStoreDB, reset the passwords for current and previous members of `$admins` and `$ops` groups, and, if a password was reused in any other system, reset it in those systems to a unique password to follow best practices. If an upgrade cannot be done immediately, reset the passwords for current and previous members of `$admins` and `$ops` groups. Avoid creating custom projections until the patch has been applied.

The weakness was shared 02/21/2024. The advisory is shared for download at github.com. This vulnerability is traded as CVE-2024-26133 since 02/14/2024. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1552.

Upgrading eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• EventStore

Name

• EventStoreDB

License

• open-source

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion