PT-2023-20160 · Datahub · Datahub

Artsploit + 6 · Published 2023-02-10 · Updated 2025-12-03 · CVE-2023-25562

Positive Technologies (AI Summary)

CVSS v3.1

6.9

Medium

Base vector

AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions DataHub versions prior to 0.8.45

Description The issue concerns authentication checks using the AuthUtils.hasValidSessionCookie() method, which could be bypassed by using a cookie from a logged out session. This is because session cookies are only cleared on new sign-in events and not on logout events. As a result, any logged out session cookie may be accepted as valid, leading to an authentication bypass to the system.

Recommendations For versions prior to 0.8.45, upgrade to version 0.8.45 or later to resolve the issue. As a temporary workaround, consider disabling the use of session cookies or restricting access to sensitive areas of the system until the upgrade can be applied.

Exploit

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

CVE-2023-25562

GHSA-3974-HXJH-M3JJ

Affected Products

Datahub

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/25xxx/CVE-2023-25562.json · Exploit
• https://github.com/datahub-project/datahub/security/advisories/GHSA-3974-hxjh-m3jj · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-25562 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-25562 · Security Note
• https://github.com/datahub-project/datahub/blob/aa146db611e3a4ca3aa17bb740783f789d4444d3/datahub-frontend/app/auth/AuthUtils.java#L78 · Note
• https://t.me/cveNotify/144678 · Telegram Post