influxData influxDB before v1.8.10 contains no authentication mechanism or controls, allowing unauthenticated attackers to execute arbitrary commands. NOTE: the CVE ID assignment is disputed because the vendor's documentation states "If InfluxDB is being deployed on a publicly accessible endpoint, we strongly recommend authentication be enabled. Otherwise the data will be publicly available to any unauthenticated user. The default settings do NOT enable authentication and authorization.

An update of the kapacitor package has been released.

An update of the influxdb package has been released.

ID	Name	Product	Family	Severity
204224	Photon OS 5.0: Kapacitor PHSA-2023-5.0-0045	Nessus	PhotonOS Local Security Checks	critical
204072	Photon OS 3.0: Influxdb PHSA-2022-3.0-0470	Nessus	PhotonOS Local Security Checks	critical
203586	Photon OS 5.0: Influxdb PHSA-2023-5.0-0009	Nessus	PhotonOS Local Security Checks	critical

Detections

Analytics

CVE-2022-36640

critical

Tenable Plugins

critical

critical

critical