DEBIAN-CVE-2022-36640

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2022-36640
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2022-36640.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2022-36640
Upstream
Published
2022-09-02T21:15:16.427Z
Modified
2025-11-20T10:15:59.615436Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

influxData influxDB before v1.8.10 contains no authentication mechanism or controls, allowing unauthenticated attackers to execute arbitrary commands. NOTE: the CVE ID assignment is disputed because the vendor's documentation states "If InfluxDB is being deployed on a publicly accessible endpoint, we strongly recommend authentication be enabled. Otherwise the data will be publicly available to any unauthenticated user. The default settings do NOT enable authentication and authorization.

References

Affected packages

Debian:11 / influxdb

Package

Name
influxdb
Purl
pkg:deb/debian/influxdb?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.6.7~rc0-1
1.6.7~rc0-2

Ecosystem specific 

{
    "urgency": "unimportant"
}

Debian:12 / influxdb

Package

Name
influxdb
Purl
pkg:deb/debian/influxdb?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.6.7~rc0-1
1.6.7~rc0-2

Ecosystem specific 

{
    "urgency": "unimportant"
}

Debian:13 / influxdb

Package

Name
influxdb
Purl
pkg:deb/debian/influxdb?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.6.7~rc0-2

Ecosystem specific 

{
    "urgency": "unimportant"
}

Debian:14 / influxdb

Package

Name
influxdb
Purl
pkg:deb/debian/influxdb?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.6.7~rc0-2

Ecosystem specific 

{
    "urgency": "unimportant"
}