CrateDB authentication bypass vulnerability
High severity
GitHub Reviewed
Published
Jan 30, 2024
to the GitHub Advisory Database
•
Updated Feb 6, 2024
Package
Affected versions
< 5.2.11
>= 5.3.0, < 5.3.8
>= 5.4.0, < 5.4.7
>= 5.5.0, < 5.5.2
Patched versions
5.2.11
5.3.8
5.4.7
5.5.2
Description
Published by the National Vulnerability Database
Jan 30, 2024
Published to the GitHub Advisory Database
Jan 30, 2024
Reviewed
Jan 30, 2024
Last updated
Feb 6, 2024
Credits
-
Tu0Laj1 Analyst
CrateDB 5.5.1 is contains an authentication bypass vulnerability in the Admin UI component. After configuring password authentication and_ Local_ In the case of an address, identity authentication can be bypassed by setting the X-Real IP request header to a specific value and accessing the Admin UI directly using the default user identity.
References