PT-2022-24818 · Mariadb+1 · Mariadb+1

Tarihub · Published 2022-09-26 · Updated 2024-08-21 · CVE-2022-39219

Positive Technologies (AI Summary)

CVSS v3.1

8.5

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L

Name of the Vulnerable Software and Affected Versions Bifrost versions 1.8.6-release and prior

Description Bifrost is a middleware package that synchronizes MySQL/MariaDB binlog data to other types of databases. The issue allows group members with only read permissions to write requests when they are normally forbidden from doing so, due to an authentication bypass when using HTTP basic authentication.

Recommendations For versions 1.8.6-release and prior, update to version 1.8.7-release to resolve the issue. As a temporary workaround, consider disabling HTTP basic authentication until a patch is applied. Restrict access to sensitive data to minimize the risk of exploitation.

Exploit

Fix

Improper Authentication

Incorrect Permission

Weakness Enumeration

CWE-287

CWE-732

Related Identifiers

CVE-2022-39219

GHSA-P6FH-XC6R-G5HW

GO-2022-1023

Affected Products

Mariadb

Mysql Server

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39219.json · Exploit
• 🔥 https://github.com/brokercap/Bifrost/issues/200 · Exploit
• https://osv.dev/vulnerability/CVE-2022-39219 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-39219 · Security Note
• https://osv.dev/vulnerability/GHSA-p6fh-xc6r-g5hw · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-1023 · Vendor Advisory
• https://github.com/brokercap/Bifrost · Note
• https://github.com/brokercap/Bifrost/releases/tag/v1.8.7-release · Note
• https://github.com/brokercap/Bifrost/security/advisories/GHSA-p6fh-xc6r-g5hw · Note
• https://t.me/cvenotify/54120 · Telegram Post
• https://t.me/cibsecurity/50487 · Telegram Post