CVE-2024-26133

Summary

CVE-2024-26133 is a vulnerability found in the projections subsystem of EventStoreDB (ESDB) versions 20 prior to 20.10.6, 21 prior to 21.10.11, 22 prior to 22.10.5, and 23 prior to 23.10.1. Only database instances using custom projections are affected by this vulnerability. It allows unauthorized access to user passwords for those who can access chunk files on disk and have read access to system streams. Users in the `$admins` group can access system streams by default. The issue has been patched in ESDB versions 23.10.1, 22.10.5, 21.10.11, and 20.10.6, so upgrading is recommended along with resetting passwords for current and previous members of `$admins` and `$ops` groups as a best practice precautionary measure against potential misuse of compromised passwords in other systems if they were reused there as well. Note: The information provided here is based on the given text and does not involve any external research or additional sources beyond the provided text snippet

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.