PT-2023-30523 · Datahub · Datahub

Amit-Laish · Publicado 2023-11-13 · Atualizado 2023-11-20 · CVE-2023-47629

Positive Technologies (AI Summary)

CVSS v3.1

7.1

Alta

Vetor base

AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions DataHub versions prior to 0.12.1

Description The issue concerns an open-source metadata platform where sign-up through an invite link does not properly restrict users from signing up as privileged accounts. If a user is given an email sign-up link, they can potentially create an admin account under certain preconditions. Specifically, if the default datahub user has been removed but the default policies applying to that user remain, a user can sign up for an account that leverages these policies to gain admin privileges. There are no known workarounds for this issue.

Recommendations Update to version 0.12.1 to address the issue.

Exploit

Correção

Improper Privilege Management

Enumeração de Fraquezas

CWE-269

Identificadores relacionados

CVE-2023-47629

GHSA-VJ59-23WW-P6C8

Produtos afetados

Datahub

Referências · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/47xxx/CVE-2023-47629.json · Exploit
• https://github.com/datahub-project/datahub/security/advisories/GHSA-vj59-23ww-p6c8 · Nota
• https://t.me/latest_high_impact_cve/90 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-47629 · Aviso do Fabricante
• https://t.me/cvenotify/60793 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-47629 · Nota de Segurança
• https://twitter.com/CVEnew/status/1724231653923643439 · Publicação no Twitter