CVE-2022-36640

published 2022-09-02

CVE-2022-36640: influxData influxDB before v1.8.10 contains no authentication mechanism or controls, allowing unauthenticated attackers to execute arbitrary commands. NOTE…

Priority P2 66 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

influxData influxDB before v1.8.10 contains no authentication mechanism or controls, allowing unauthenticated attackers to execute arbitrary commands. NOTE: the CVE ID assignment is disputed because the vendor's documentation states "If InfluxDB is being deployed on a publicly accessible endpoint, we strongly recommend authentication be enabled. Otherwise the data will be publicly available to any unauthenticated user. The default settings do NOT enable authentication and authorization.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
debian	influxdb	—	—
influxdata	influxdb	< 1.8.0	1.8.0

Detection & IOCs extracted from sources · hover to see the quote

• → InfluxDB instances with no authentication enabled are exploitable by unauthenticated attackers; detect unauthenticated HTTP requests to InfluxDB endpoints (default port 8086) from unexpected sources ↗
• → The default InfluxDB configuration does NOT enable authentication and authorization; audit deployments for missing auth config as an indicator of vulnerable exposure ↗

• · Multiple Debian releases (bookworm, bullseye, forky, sid, trixie) remain open/unpatched as of the Debian Security Tracker, indicating wide exposure on Debian-based deployments. ↗

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

osv 9.8 CRITICAL

vendor_debian 9.8 LOW

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-276