GHSA-5r3p-6rj5-7937
Bytebase vulnerable to Improper Authentication
At a glance
- Published
- Updated
- CVE
- CVE-2022-51026
- CVSS_V4
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U
Description
### Impact - GitLab login allows login by any user. - JWT auth token can be derived as long as the server isn't rebooted. - Developers can assign issues to non-admin/DBA users.
Affected packages
| Package | Versions |
|---|---|
| Go · github.com/bytebase/bytebase | introduced 0, fixed 1.0.1 |
References
- https://github.com/bytebase/bytebase/security/advisories/GHSA-5r3p-6rj5-7937 WEB
- https://github.com/bytebase/bytebase/commit/a578ed58e478ba5c2dadf8d538ec5c3d39c28461 WEB
- https://github.com/bytebase/bytebase PACKAGE
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |