influxData influxDB before v1.8.10 contains no authentication mechanism or controls, allowing unauthenticated attackers to execute arbitrary commands. NOTE: the CVE ID assignment is disputed because the vendor's documentation states "If InfluxDB is being deployed on a publicly accessible endpoint, we strongly recommend authentication be enabled. Otherwise the data will be publicly available to any unauthenticated user. The default settings do NOT enable authentication and authorization."

An update of the influxdb package has been released.

An update of the kapacitor package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - influxData influxDB before v1.8.10 contains no authentication mechanism or controls, allowing     unauthenticated attackers to execute arbitrary commands. NOTE: the CVE ID assignment is disputed because     the vendor's documentation states If InfluxDB is being deployed on a publicly accessible endpoint, we     strongly recommend authentication be enabled. Otherwise the data will be publicly available to any     unauthenticated user. The default settings do NOT enable authentication and authorization.
    (CVE-2022-36640)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
334113	Photon OS 5.0: Influxdb PHSA-2023-5.0-92-0009	Nessus	PhotonOS Local Security Checks	Local	critical
333883	Photon OS 5.0: Influxdb PHSA-2023-5.0-90-0009	Nessus	PhotonOS Local Security Checks	Local	critical
333772	Photon OS 5.0: Influxdb PHSA-2023-5.0-91-0009	Nessus	PhotonOS Local Security Checks	Local	critical
332194	Photon OS 5.0: Kapacitor PHSA-2023-5.0-91-0045	Nessus	PhotonOS Local Security Checks	Local	critical
258933	Linux Distros Unpatched Vulnerability : CVE-2022-36640	Nessus	Misc.	Local	critical
204224	Photon OS 5.0: Kapacitor PHSA-2023-5.0-0045	Nessus	PhotonOS Local Security Checks	Local	critical
204072	Photon OS 3.0: Influxdb PHSA-2022-3.0-0470	Nessus	PhotonOS Local Security Checks	Local	critical
203586	Photon OS 5.0: Influxdb PHSA-2023-5.0-0009	Nessus	PhotonOS Local Security Checks	Local	critical

Detections

Analytics

CVE-2022-36640

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical