CVE-2024-261335.5MediumCWE-256

CVE-2024-26133: EventStoreDB Projections Subsystem has potential password leak

EventStore

Vendor fix available · Affected: EventStore · Exploitation: unlikely (under 1%)

Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.

0.6%probability of exploitation in the next 30 days

50th percentile

050100

Higher than 50% of scored CVEs

5.5MediumCVSS 3.1

LowMediumHighCrit.

DescriptionCVE.org

EventStoreDB (ESDB) is an operational database built to store events. A vulnerability has been identified in the projections subsystem in versions 20 prior to 20.10.6, 21 prior to 21.10.11, 22 prior to 22.10.5, and 23 prior to 23.10.1. Only database instances that use custom projections are affected by this vulnerability. User passwords may become accessible to those who have access to the chunk files on disk, and users who have read access to system streams. Only users in the `$admins` group can access system streams by default. ESDB 23.10.1, 22.10.5, 21.10.11, and 20.10.6 contain a patch for this issue. Users should upgrade EventStoreDB, reset the passwords for current and previous members of `$admins` and `$ops` groups, and, if a password was reused in any other system, reset it in those systems to a unique password to follow best practices. If an upgrade cannot be done immediately, reset the passwords for current and previous members of `$admins` and `$ops` groups. Avoid creating custom projections until the patch has been applied.

Affected products1

From the CVE record. A product or version that is not listed is unknown, not unaffected.

EventStore · EventStore>= 23.0.0, < 23.10.1; >= 22.0.0, < 22.10.5; >= 21.0.0, < 21.10.11; >= 20.0.0, < 20.10.6

On the Atlas

Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.

Open the Atlas

Exploitation: Unlikely (under 1%). EPSS under 1%, or no score yet.
CISA KEV: Not listed
Public check: No public nuclei template
Weakness: Plaintext Storage of a Password · Authentication
Published: February 2024
Band: Unlikely (under 1%), February 2024

CoverageNo articles yet

No CyberSIXT article names CVE-2024-26133 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.