Executive brief
VTAdmin users that can create shards can deny access to other functions
Affected products
- Go vitess.io/vitess
Junglewise Threat Intelligence
CVE-2023-29195: VTAdmin users that can create shards can deny access to other functions
CVE-2023-29195 · Severity: low · CVSS 3.1 · Published 2023-05-11
Technologies: vitess.io/vitess (Go). Vendors: Go.
Related threats
- Vitess is a database clustering system for horizontal scaling of MySQL. In 24.0.2 and earlier, the /debug/vrlog endpoint registered by addHt
- GO-2026-4570 - Vitess users with backup storage access can write to arbitrary file paths in vitess.io/vitess
- GO-2026-4567 - Vitess users can gain unauthorized access to production deployment environments in vitess.io/vitess
- GO-2024-3306 - Vitess allows HTML injection in /debug/querylogz and /debug/env in vitess.io/vitess
- GO-2024-2826 - Denial of service attack by triggering unbounded memory usage in vitess.io/vitess