PatchTheCVEinfluxdata vulnerabilities
Recent CVEs affecting influxdata products. 4 tracked.
influxdata has 4 tracked vulnerabilities, 3 critical. A fixed release or vendor patch exists for 4. Most recent: 2022-09-02. Highest priority: CVE-2019-20933 (score 69/100).
- CVE-2022-36640 CRITICAL 9.8 UPGRADE influxData influxDB before v1.8.10 contains no authentication mechanism or controls, allowing unauthenticated
- CVE-2020-35187 CRITICAL 9.8 UPGRADE The official telegraf docker images before 1.9.4-alpine (Alpine specific) contain a blank password for a root
- CVE-2019-20933 CRITICAL 9.8 UPGRADE MITIGATE InfluxDB before 1.7.6 has an authentication bypass vulnerability in the authenticate function in services/http
- CVE-2018-17572 MEDIUM 4.8 UPGRADE InfluxDB 0.9.5 has Reflected XSS in the Write Data module.
FAQ
How do I fix influxdata vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is influxdata being exploited right now?
None of the tracked influxdata CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which influxdata CVE should I patch first?
CVE-2019-20933 currently ranks highest (69/100): InfluxDB before 1.7.6 has an authentication bypass vulnerability in the authenticate function in services/http.