CVE Vulnerabilities

CVE-2023-1995

Insufficient Logging

Published: Aug 29, 2023 | Modified: Nov 21, 2024
CVSS 3.x
7.5
HIGH
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS 2.x
RedHat/V2
RedHat/V3
Ubuntu

Insufficient Logging vulnerability in Hitachi HiRDB Server, HiRDB Server With Addtional Function, HiRDB Structured Data Access Facility.This issue affects HiRDB Server: before 09-60-39, before 09-65-23,

before 09-66-17,

before 10-01-10, before 10-03-12, before 10-04-06, before 10-05-06, before 10-06-02; HiRDB Server With Addtional Function: before 09-60-2M, before 09-65-/W

, before 09-66-/Q

; HiRDB Structured Data Access Facility: before 09-60-39, before 10-03-12, before 10-04-06, before 10-06-02.

Weakness

When a security-critical event occurs, the product either does not record the event or omits important details about the event when logging it.

Affected Software

Name Vendor Start Version End Version
Hirdb_server_with_additional_function Hitachi 09-00 (including) 09-00-2d (including)
Hirdb_server_with_additional_function Hitachi 09-01 (including) 09-01-/x (including)
Hirdb_server_with_additional_function Hitachi 09-02 (including) 09-02-2f (including)
Hirdb_server_with_additional_function Hitachi 09-03 (including) 09-03-2a (including)
Hirdb_server_with_additional_function Hitachi 09-04 (including) 09-04-2s (including)
Hirdb_server_with_additional_function Hitachi 09-50 (including) 09-50-2k (including)
Hirdb_server_with_additional_function Hitachi 09-60 (including) 09-60-2k (including)
Hirdb_server_with_additional_function Hitachi 09-65 (including) 09-65-/v (including)
Hirdb_server_with_additional_function Hitachi 09-66 (including) 09-66-/p (including)

Extended Description

When security-critical events are not logged properly, such as a failed login attempt, this can make malicious behavior more difficult to detect and may hinder forensic analysis after an attack succeeds. As organizations adopt cloud storage resources, these technologies often require configuration changes to enable detailed logging information, since detailed logging can incur additional costs. This could lead to telemetry gaps in critical audit logs. For example, in Azure, the default value for logging is disabled.

Potential Mitigations

References