Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
mation is for Diagnostics Agent Connection via Java SCS Message Server of an SAP Solution Manager system and can only be accessed by authenticated SAP Landscape Management users, but they can escalate their privileges to the SAP Solution Manager system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://launchpad.support.sap.com/#/notes/3312733 - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
CVE ID: CVE-2023-26459 State: PUBLISHED Published: 2023-03-14T04:45:51.958Z Last Updated: 2025-02-27T18:05:47.515Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L) Vendors: SAP Products: NetWeaver AS for ABAP and ABAP Platform Problem Types: CWE-918 Description: Due to improper input controls In SAP NetWeaver AS for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, an attacker authenticated as a non-administrative user can craft a request which will trigger the application server to send a request to an arbitrary URL which can reveal, modify or make unavailable non-sensitive information, leading to low impact on Conf
o an arbitrary URL which can reveal, modify or make unavailable non-sensitive information, leading to low impact on Confidentiality, Integrity and Availability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://launchpad.support.sap.com/#/notes/3296346 - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
CVE ID: CVE-2023-26460 State: PUBLISHED Published: 2023-03-14T04:56:08.985Z Last Updated: 2025-02-27T15:09:25.265Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: SAP Products: NetWeaver AS for Java Problem Types: CWE-284 Description: Cache Management Service in SAP NetWeaver Application Server for Java - version 7.50, does not perform any authentication checks for functionalities that require user identity Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://launchpad.support.sap.com/#/notes/3288096 - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
CVE ID: CVE-2023-26461 State: PUBLISHED Published: 2023-03-14T04:56:47.419Z Last Updated: 2025-02-27T15:08:31.768Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N) Vendors: SAP Products: NetWeaver (SAP Enterprise Portal) Problem Types: CWE-611 Description: SAP NetWeaver allows (SAP Enterprise Portal) - version 7.50, allows an authenticated attacker with sufficient privileges to access the XML parser which can submit a crafted XML file which when parsed will enable them to access but not modify sensitive files and data. It allows the attacker to view sensitive data which is owned by certain privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnr
sensitive data which is owned by certain privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://launchpad.support.sap.com/#/notes/3284550 - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
CVE ID: CVE-2023-26462 State: PUBLISHED Published: 2023-02-23T00:00:00.000Z Last Updated: 2025-03-12T14:20:09.537Z Vendors: n/a Products: n/a Problem Types: n/a Description: ThingsBoard 3.4.1 could allow a remote attacker to gain elevated privileges because hard-coded service credentials (usable for privilege escalation) are stored in an insecure format. (To read this stored data, the attacker needs access to the application server or its source code.) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://thingsboard.io/docs/reference/releases/ - https://exchange.xforce.ibmcloud.com/vulnerabilities/238544
CVE ID: CVE-2023-26463 State: PUBLISHED Published: 2023-04-14T00:00:00.000Z Last Updated: 2025-02-13T16:44:54.990Z Vendors: n/a Products: n/a Problem Types: n/a Description: strongSwan 5.9.8 and 5.9.9 potentially allows remote code execution because it uses a variable named "public" for two different purposes within the same function. There is initially incorrect access control, later followed by an expired pointer dereference. One attack vector is sending an untrusted client certificate during EAP-TLS. A server is affected only if it loads plugins that implement TLS-based EAP methods (EAP-TLS, EAP-TTLS, EAP-PEAP, or EAP-TNC). This is fixed in 5.9.10. Additional Analyst Notes: - CVE Program
EAP methods (EAP-TLS, EAP-TTLS, EAP-PEAP, or EAP-TNC). This is fixed in 5.9.10. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/strongswan/strongswan/releases - https://www.strongswan.org/blog/2023/03/02/strongswan-vulnerability-%28cve-2023-26463%29.html - https://security.netapp.com/advisory/ntap-20230517-0010/
CVE ID: CVE-2023-26464 State: PUBLISHED Published: 2023-03-10T13:38:16.190Z Last Updated: 2025-02-13T16:44:55.555Z Vendors: Apache Software Foundation Products: Apache Log4j Problem Types: CWE-502 Description: ** UNSUPPORTED WHEN ASSIGNED ** When using the Chainsaw or SocketAppender components with Log4j 1.x on JRE less than 1.7, an attacker that manages to cause a logging entry involving a specially-crafted (ie, deeply nested) hashmap or hashtable (depending on which logging component is in use) to be processed could exhaust the available memory in the virtual machine and achieve Denial of Service when the object is deserialized. This issue affects Apache Log4j before 2. Affected users are
achieve Denial of Service when the object is deserialized. This issue affects Apache Log4j before 2. Affected users are recommended to update to Log4j 2.x. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/wkx6grrcjkh86crr49p4blc1v1nflj3t - https://security.netapp.com/advisory/ntap-20230505-0008/
CVE ID: CVE-2023-26465 State: PUBLISHED Published: 2023-06-09T00:00:00 Last Updated: 2025-01-06T19:24:44.238Z Severity: HIGH (CVSS 8 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Pegasystems Products: Pega Infinity Problem Types: CWE-79 Description: Pega Platform versions 7.2 to 8.8.1 are affected by an XSS issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.pega.com/support-doc/pega-security-advisory-a23-vulnerability-remediation-note
CVE ID: CVE-2023-26466 State: PUBLISHED Published: 2023-04-10T00:00:00.000Z Last Updated: 2025-02-10T15:19:31.692Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Pegasystems Products: RPA: Synchronization Engine Problem Types: CWE-285 Description: A user with non-Admin access can change a configuration file on the client to modify the Server URL. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.pega.com/support-doc/pega-security-advisory-b23-robotics-and-workforce-intelligence-local-privilege
CVE ID: CVE-2023-26467 State: PUBLISHED Published: 2023-04-10T00:00:00.000Z Last Updated: 2025-02-07T20:12:55.654Z Severity: HIGH (CVSS 8.1 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) Vendors: Pegasystems Products: RPA: Synchronization Engine Problem Types: CWE-345 Description: A man in the middle can redirect traffic to a malicious server in a compromised configuration. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.pega.com/support-doc/pega-security-advisory-b23-robotics-and-workforce-intelligence-local-privilege
CVE ID: CVE-2023-26468 State: PUBLISHED Published: 2023-02-23T00:00:00.000Z Last Updated: 2025-03-12T14:05:52.622Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cerebrate 1.12 does not properly consider organisation_id during creation of API keys. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/cerebrate-project/cerebrate/commit/7ccf9252470a23acc38ad6ed13eecf523e368b48
CVE ID: CVE-2023-26469 State: PUBLISHED Published: 2023-08-17T00:00:00 Last Updated: 2024-10-08T16:00:51.499Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Jorani 1.0.0, an attacker could leverage path traversal to access files and execute code on the server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jorani.org/security-features-in-lms.html - https://github.com/Orange-Cyberdefense/CVE-repository/tree/master - http://packetstormsecurity.com/files/174248/Jorani-Remote-Code-Execution.html
CVE ID: CVE-2023-26470 State: PUBLISHED Published: 2023-03-02T18:37:23.588Z Last Updated: 2025-03-05T20:40:56.633Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H) Vendors: xwiki Products: xwiki-platform Problem Types: CWE-400 Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to make the farm unusable by adding an object to a page with a huge number (e.g. 67108863). Most of the time this will fill the memory allocated to XWiki and make it unusable every time this document is manipulated. This issue has been patched in XWiki 14.0-rc-1. Additional Analyst Notes: - CVE Program Container: -
nt is manipulated. This issue has been patched in XWiki 14.0-rc-1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-92wp-r7hm-42g7 - https://github.com/xwiki/xwiki-platform/commit/04e5a89d2879b160cdfaea846024d3d9c1a525e6 - https://github.com/xwiki/xwiki-platform/commit/db3d1c62fc5fb59fefcda3b86065d2d362f55164 - https://github.com/xwiki/xwiki-platform/commit/fdfce062642b0ac062da5cda033d25482f4600fa - https://jira.xwiki.org/browse/XWIKI-19223
CVE ID: CVE-2023-26471 State: PUBLISHED Published: 2023-03-02T18:28:52.037Z Last Updated: 2025-03-05T19:54:04.360Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: xwiki Products: xwiki-platform Problem Types: CWE-284 Description: XWiki Platform is a generic wiki platform. Starting in version 11.6-rc-1, comments are supposed to be executed with the right of superadmin but in restricted mode (anything dangerous is disabled), but the async macro does not take into account the restricted mode. This means that any user with comment right can use the async macro to make it execute any wiki content with the right of superadmin. This has been patched in XWiki 14.9,
e the async macro to make it execute any wiki content with the right of superadmin. This has been patched in XWiki 14.9, 14.4.6, and 13.10.10. The only known workaround consists of applying a patch and rebuilding and redeploying `org.xwiki.platform:xwiki-platform-rendering-async-macro`. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-9cqm-5wf7-wcj7 - https://github.com/xwiki/xwiki-platform/commit/00532d9f1404287cf3ec3a05056640d809516006 - https://jira.xwiki.org/browse/XWIKI-20234
CVE ID: CVE-2023-26472 State: PUBLISHED Published: 2023-03-02T18:25:06.051Z Last Updated: 2025-03-05T20:44:32.268Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: xwiki Products: xwiki-platform Problem Types: CWE-116 Description: XWiki Platform is a generic wiki platform. Starting in version 6.2-milestone-1, one can execute any wiki content with the right of IconThemeSheet author by creating an icon theme with certain content. This can be done by creating a new page or even through the user profile for users not having edit right. The issue has been patched in XWiki 14.9, 14.4.6, and 13.10.10. An available workaround is to fix the bug in the page `IconTheme
e has been patched in XWiki 14.9, 14.4.6, and 13.10.10. An available workaround is to fix the bug in the page `IconThemesCode.IconThemeSheet` by applying a modification from commit 48caf7491595238af2b531026a614221d5d61f38. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-vwr6-qp4q-2wj7 - https://github.com/xwiki/xwiki-platform/commit/48caf7491595238af2b531026a614221d5d61f38#diff-2ec9d716673ee049937219cdb0a92e520f81da14ea84d144504b97ab2bdae243R45 - https://jira.xwiki.org/browse/XWIKI-19731
CVE ID: CVE-2023-26473 State: PUBLISHED Published: 2023-03-02T18:17:09.152Z Last Updated: 2025-03-05T20:46:44.895Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: xwiki Products: xwiki-platform Problem Types: CWE-284 Description: XWiki Platform is a generic wiki platform. Starting in version 1.3-rc-1, any user with edit right can execute arbitrary database select and access data stored in the database. The problem has been patched in XWiki 13.10.11, 14.4.7, and 14.10. There is no workaround for this vulnerability other than upgrading. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-plat
ional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-vpx4-7rfp-h545 - https://jira.xwiki.org/browse/XWIKI-19523
CVE ID: CVE-2023-26474 State: PUBLISHED Published: 2023-03-02T18:12:16.209Z Last Updated: 2025-03-05T21:21:51.637Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: xwiki Products: xwiki-platform Problem Types: CWE-284 Description: XWiki Platform is a generic wiki platform. Starting in version 13.10, it's possible to use the right of an existing document content author to execute a text area property. This has been patched in XWiki 14.10, 14.4.7, and 13.10.11. There are no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-3738-p9x3-mv9r
- CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-3738-p9x3-mv9r - https://jira.xwiki.org/browse/XWIKI-20373
CVE ID: CVE-2023-26475 State: PUBLISHED Published: 2023-03-02T18:07:04.129Z Last Updated: 2025-03-05T21:23:14.514Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: xwiki Products: xwiki-platform Problem Types: CWE-270, CWE-269 Description: XWiki Platform is a generic wiki platform. Starting in version 2.3-milestone-1, the annotation displayer does not execute the content in a restricted context. This allows executing anything with the right of the author of any document by annotating the document. This has been patched in XWiki 13.10.11, 14.4.7 and 14.10. There is no easy workaround except to upgrade. Additional Analyst Notes: - CVE Program Container: - CISA
.4.7 and 14.10. There is no easy workaround except to upgrade. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-h6f5-8jj5-cxhr - https://github.com/xwiki/xwiki-platform/commit/d87d7bfd8db18c20d3264f98c6deefeae93b99f7 - https://jira.xwiki.org/browse/XWIKI-20360 - https://jira.xwiki.org/browse/XWIKI-20384
CVE ID: CVE-2023-26476 State: PUBLISHED Published: 2023-03-02T18:02:20.328Z Last Updated: 2025-03-05T21:24:50.665Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: xwiki Products: xwiki-platform Problem Types: CWE-200 Description: XWiki Platform is a generic wiki platform. Starting in version 3.2-m3, users can deduce the content of the password fields by repeated call to `LiveTableResults` and `WikisLiveTableResultsMacros`. The issue can be fixed by upgrading to versions 14.7-rc-1, 13.4.4, or 13.10.9 and higher, or in version >= 3.2M3 by applying the patch manually on `LiveTableResults` and `WikisLiveTableResultsMacros`. Additional Analyst Notes: - CVE Program
ing the patch manually on `LiveTableResults` and `WikisLiveTableResultsMacros`. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-5cf8-vrr8-8hjm - https://github.com/xwiki/xwiki-platform/commit/7f8825537c9523ccb5051abd78014d156f9791c8 - https://jira.xwiki.org/browse/XWIKI-19949
CVE ID: CVE-2023-26477 State: PUBLISHED Published: 2023-03-02T17:52:40.359Z Last Updated: 2025-03-05T21:27:38.903Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: xwiki Products: xwiki-platform Problem Types: CWE-95 Description: XWiki Platform is a generic wiki platform. Starting in versions 6.3-rc-1 and 6.2.4, it's possible to inject arbitrary wiki syntax including Groovy, Python and Velocity script macros via the `newThemeName` request parameter (URL parameter), in combination with additional parameters. This has been patched in the supported versions 13.10.10, 14.9-rc-1, and 14.4.6. As a workaround, it is possible to edit `FlamingoThemesCode.WebHomeSheet
orted versions 13.10.10, 14.9-rc-1, and 14.4.6. As a workaround, it is possible to edit `FlamingoThemesCode.WebHomeSheet` and manually perform the changes from the patch fixing the issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-x2qm-r4wx-8gpg - https://github.com/xwiki/xwiki-platform/commit/ea2e615f50a918802fd60b09ec87aa04bc6ea8e2#diff-e2153fa59f9d92ef67b0afbf27984bd17170921a3b558fac227160003d0dfd2aR283-R284 - https://jira.xwiki.org/browse/XWIKI-19757
CVE ID: CVE-2023-26478 State: PUBLISHED Published: 2023-03-02T17:46:15.394Z Last Updated: 2025-03-05T20:49:02.330Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L) Vendors: xwiki Products: xwiki-platform Problem Types: CWE-749 Description: XWiki Platform is a generic wiki platform. Starting in version 14.3-rc-1, `org.xwiki.store.script.TemporaryAttachmentsScriptService#uploadTemporaryAttachment` returns an instance of `com.xpn.xwiki.doc.XWikiAttachment`. This class is not supported to be exposed to users without the `programing` right. `com.xpn.xwiki.api.Attachment` should be used instead and takes case of checking the user's rights before performing dangerous operati
.api.Attachment` should be used instead and takes case of checking the user's rights before performing dangerous operations. This has been patched in versions 14.9-rc-1 and 14.4.6. There are no known workarounds for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-8692-g6g9-gm5p - https://github.com/xwiki/xwiki-platform/commit/3c73c59e39b6436b1074d8834cf276916010014d - https://jira.xwiki.org/browse/XWIKI-20180
CVE ID: CVE-2023-26479 State: PUBLISHED Published: 2023-03-02T17:20:18.643Z Last Updated: 2025-03-05T20:49:41.980Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: xwiki Products: xwiki-platform Problem Types: CWE-755 Description: XWiki Platform is a generic wiki platform. Starting in version 6.0, users with write rights can insert well-formed content that is not handled well by the parser. As a consequence, some pages becomes unusable, including the user index (if the page containing the faulty content is a user page) and the page index. Note that on the page, the normal UI is completely missing and it is not possible to open the editor directly to revert th
te that on the page, the normal UI is completely missing and it is not possible to open the editor directly to revert the change as the stack overflow is already triggered while getting the title of the document. This means that it is quite difficult to remove this content once inserted. This has been patched in XWiki 13.10.10, 14.4.6, and 14.9-rc-1. A temporary workaround to avoid Stack Overflow errors is to increase the memory allocated to the stack by using the `-Xss` JVM parameter (e.g., `-Xss32m`). This should allow the parser to pass and to fix the faulty content. The consequences for other aspects of the system (e.g., performance) are unknown, and this workaround should be only be use
consequences for other aspects of the system (e.g., performance) are unknown, and this workaround should be only be used as a temporary solution. The workaround does not prevent the issue occurring again with other content. Consequently, it is strongly advised to upgrade to a version where the issue has been patched. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-52vf-hvv3-98h7 - https://github.com/xwiki/xwiki-platform/commit/e5b82cd98072464196a468b8f7fe6396dce142a7 - https://jira.xwiki.org/browse/XWIKI-19838
CVE ID: CVE-2023-26480 State: PUBLISHED Published: 2023-03-02T17:09:18.909Z Last Updated: 2025-03-05T20:50:21.886Z Severity: HIGH (CVSS 8.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L) Vendors: xwiki Products: xwiki-platform Problem Types: CWE-79 Description: XWiki Platform is a generic wiki platform. Starting in version 12.10, a user without script rights can introduce a stored cross-site scripting by using the Live Data macro. This has been patched in XWiki 14.9, 14.4.7, and 13.10.10. There are no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-32fq-m2q5-h83g - htt
SA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-32fq-m2q5-h83g - https://github.com/xwiki/xwiki-platform/commit/23d5ea9b23e84b5f3d1f1b2d5673fe8c774d0d79 - https://github.com/xwiki/xwiki-platform/commit/556e7823260b826f344c1a6e95d935774587e028 - https://jira.xwiki.org/browse/XWIKI-20143
CVE ID: CVE-2023-26481 State: PUBLISHED Published: 2023-03-04T00:30:16.509Z Last Updated: 2025-02-25T15:01:34.943Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: goauthentik Products: authentik Problem Types: CWE-345 Description: authentik is an open-source Identity Provider. Due to an insufficient access check, a recovery flow link that is created by an admin (or sent via email by an admin) can be used to set the password for any arbitrary user. This attack is only possible if a recovery flow exists, which has both an Identification and an Email stage bound to it. If the flow has policies on the identification stage to skip it when the flow is restored (
an Email stage bound to it. If the flow has policies on the identification stage to skip it when the flow is restored (by checking `request.context['is_restored']`), the flow is not affected by this. With this flow in place, an administrator must create a recovery Link or send a recovery URL to the attacker, who can, due to the improper validation of the token create, set the password for any account. Regardless, for custom recovery flows it is recommended to add a policy that checks if the flow is restored, and skips the identification stage. This issue has been fixed in versions 2023.2.3, 2023.1.3 and 2022.12.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: R
versions 2023.2.3, 2023.1.3 and 2022.12.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/goauthentik/authentik/security/advisories/GHSA-3xf5-pqvf-rqq3 - https://goauthentik.io/docs/releases/2023.2#fixed-in-202323