CVE-2023-46740

Summary

CVE-2023-46740 affects the open-source cloud-native file storage system, CubeFS, before version 3.3.1. The vulnerability stems from an insecure random string generator used to create sensitive user keys, specifically the "accessKey". This issue makes it easy for attackers to predict and impersonate users, granting them higher privileges. New user accessKeys are generated using the insecure string generator, increasing the risk of unauthorized access. To mitigate this vulnerability, users must upgrade to CubeFS version 3.3.1. There are currently no alternative solutions.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.