{"id":"CVE-2023-22948","url":"https://www.cyber-defence.io/tools/cve/CVE-2023-22948","generatedAt":"2026-10-27T17:45:53.682Z","title":"With this, an attacker is granted password-less SSH access to all machines in the TigerGraph cluster.","description":"An issue was discovered in TigerGraph Enterprise Free Edition 3.x. There is unsecured read access to an SSH private key. Any code that runs as the tigergraph user is able to read the SSH private key. With this, an attacker is granted password-less SSH access to all machines in the TigerGraph cluster.","published":"2023-04-13T19:15:08.000Z","lastModified":"2026-06-17T05:36:29.000Z","status":"Modified","sourceIdentifier":"cve@mitre.org","cvss":{"version":"3.1","score":4.9,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"},"cwe":["CWE-311"],"affected":["tigergraph/tigergraph"],"epss":{"score":0.0044,"percentile":0.37959,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.44%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"https://dev.tigergraph.com/forum/c/tg-community/announcements/35","tags":["Vendor Advisory"],"source":"cve@mitre.org"},{"url":"https://neo4j.com/security/cve-2023-22948/","tags":["Exploit","Third Party Advisory"],"source":"cve@mitre.org"},{"url":"https://dev.tigergraph.com/forum/c/tg-community/announcements/35","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://neo4j.com/security/cve-2023-22948/","tags":["Exploit","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2023-22948","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}