PT-2023-20160 · Datahub · Datahub

Artsploit + 6 · Publicado 2023-02-10 · Atualizado 2025-12-03 · CVE-2023-25562

Positive Technologies (AI Summary)

CVSS v3.1

6.9

Média

Vetor base

AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions DataHub versions prior to 0.8.45

Description The issue concerns authentication checks using the AuthUtils.hasValidSessionCookie() method, which could be bypassed by using a cookie from a logged out session. This is because session cookies are only cleared on new sign-in events and not on logout events. As a result, any logged out session cookie may be accepted as valid, leading to an authentication bypass to the system.

Recommendations For versions prior to 0.8.45, upgrade to version 0.8.45 or later to resolve the issue. As a temporary workaround, consider disabling the use of session cookies or restricting access to sensitive areas of the system until the upgrade can be applied.

Exploit

Correção

Insufficient Session Expiration

Enumeração de Fraquezas

CWE-613

Identificadores relacionados

CVE-2023-25562

GHSA-3974-HXJH-M3JJ

Produtos afetados

Datahub

Referências · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/25xxx/CVE-2023-25562.json · Exploit
• https://github.com/datahub-project/datahub/security/advisories/GHSA-3974-hxjh-m3jj · Aviso do Fabricante
• https://github.com/datahub-project/datahub/blob/aa146db611e3a4ca3aa17bb740783f789d4444d3/datahub-frontend/app/auth/AuthUtils.java#L78 · Nota
• https://t.me/cveNotify/144678 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-25562 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-25562 · Nota de Segurança