CVE-2022-37397

—

CVSS 3.1

9.8 critical

EPSS

<1%p57

Published

Aug 12, 2022 (Aug 12, 2022)

Modified

Jun 17, 2026

Description

An issue was discovered in the YugabyteDB 2.6.1 when using LDAP-based authentication in YCQL with Microsoft’s Active Directory. When anonymous or unauthenticated LDAP binding is enabled, it allows bypass of authentication with an empty password.

Vendors: yugabyte
Products: yugabytedb
Weakness: CWE-16, CWE-287
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.9%)

In the news0 stories

No ingested article mentions this CVE yet.