PT-2023-20659 · Cerebrate · Cerebrate

Published 2023-02-23 · Updated 2023-03-03 · CVE-2023-26468

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Cerebrate version 1.12

Description The issue arises from the improper consideration of organisation id during the creation of API keys. This could potentially lead to unauthorized access or misuse of API keys.

Recommendations For Cerebrate version 1.12, consider restricting access to API key creation until a proper fix is implemented to correctly handle organisation id. As a temporary workaround, manually verify the organisation id for each API key created to ensure it aligns with the intended organization.

Fix

Related Identifiers

CVE-2023-26468

Affected Products

Cerebrate

References · 4

• https://github.com/cerebrate-project/cerebrate/commit/7ccf9252470a23acc38ad6ed13eecf523e368b48 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-26468 · Security Note
• https://osv.dev/vulnerability/CVE-2023-26468 · Vendor Advisory
• https://t.me/cibsecurity/58840 · Telegram Post