PT-2023-30523 · Datahub · Datahub

Amit-Laish · Published 2023-11-13 · Updated 2023-11-20 · CVE-2023-47629

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions DataHub versions prior to 0.12.1

Description The issue concerns an open-source metadata platform where sign-up through an invite link does not properly restrict users from signing up as privileged accounts. If a user is given an email sign-up link, they can potentially create an admin account under certain preconditions. Specifically, if the default datahub user has been removed but the default policies applying to that user remain, a user can sign up for an account that leverages these policies to gain admin privileges. There are no known workarounds for this issue.

Recommendations Update to version 0.12.1 to address the issue.

Exploit

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2023-47629

GHSA-VJ59-23WW-P6C8

Affected Products

Datahub

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/47xxx/CVE-2023-47629.json · Exploit
• https://osv.dev/vulnerability/CVE-2023-47629 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-47629 · Security Note
• https://github.com/datahub-project/datahub/security/advisories/GHSA-vj59-23ww-p6c8 · Note
• https://t.me/latest_high_impact_cve/90 · Telegram Post
• https://t.me/cvenotify/60793 · Telegram Post
• https://twitter.com/CVEnew/status/1724231653923643439 · Twitter Post