debian/influxdb vulnerabilities

Latest debian/influxdb CVEs

Newest publication first

1. CVE-2024-30896 InfluxDB OSS 2.x through 2.7.11 stores the administrative operator token under the default organization which allows authorized users with read access to the authorization resource of the default orga...

   Published 2024-11-21

   Critical·CVSS 9.1 EPSS 5.3%

   InfluxDB OSS 2.x through 2.7.11 stores the administrative operator token under the default organization which allows authorized users with read access to the authorization resource of the default organization to retrieve the operator token. InfluxDB OSS 1.x, Enterprise, Cloud, Cl...

2. DSA-4823-1 influxdb - security update

   Published 2021-01-01

   Unknown

3. DLA-2501-1 influxdb - security update

   Published 2020-12-20

   Unknown

4. CVE-2019-20933 Improper Authentication in InfluxDB

   Published 2020-11-19

   Critical·CVSS 9.8 EPSS 32.3%

   InfluxDB before 1.7.6 has an authentication bypass vulnerability in the authenticate function in services/httpd/handler.go because a JWT token may have an empty SharedSecret (aka shared secret).

5. CVE-2018-17572 InfluxDB Reflected Cross-site Scripting

   Published 2020-03-02

   Medium·CVSS 4.8 EPSS 0.73%

   InfluxDB 0.9.5 has Reflected XSS in the Write Data module.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.