deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-38570
Published: 2023-11-14
Description: Access of memory location after end of buffer for some Intel Unison software may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-788
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00963.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00963.html
CVE: CVE-2023-39221
Published: 2023-11-14
Description: Improper access control for some Intel Unison software may allow an authenticated user to potentially enable escalation of privilege via network access.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-284
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00963.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00963.html
CVE: CVE-2023-39228
Published: 2023-11-14
Description: Improper access control for some Intel Unison software may allow an unauthenticated user to potentially enable denial of service via network access.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00963.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00963.html
CVE: CVE-2023-39230
Published: 2023-11-14
Description: Insecure inherited permissions in some Intel Rapid Storage Technology software before version 16.8.5.1014.9 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-277, CWE-732
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00961.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00961.html
CVE: CVE-2023-39411
Published: 2023-11-14
Description: Improper input validationation for some Intel Unison software may allow a privileged user to potentially enable denial of service via local access.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00963.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00963.html
CVE: CVE-2023-39412
Published: 2023-11-14
Description: Cross-site request forgery in some Intel Unison software may allow an authenticated user to potentially enable escalation of privilege via network access.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00963.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00963.html
CVE: CVE-2023-40220
Published: 2023-11-14
Description: Improper buffer restrictions in some Intel(R) NUC BIOS firmware may allow a privileged user to potentially enable information disclosure via local access.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-92
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01001.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01001.html
CVE: CVE-2023-40540
Published: 2023-11-14
Description: Non-Transparent Sharing of Microarchitectural Resources in some Intel(R) NUC BIOS firmware may allow a privileged user to potentially enable information disclosure via local access.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-1303
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01001.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01001.html
CVE: CVE-2023-40719
Published: 2023-11-14
Description: A use of hard-coded credentials vulnerability in Fortinet FortiAnalyzer and FortiManager 7.0.0 - 7.0.8, 7.2.0 - 7.2.3 and 7.4.0 allows an attacker to access Fortinet private testing data via the use of static credentials.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-798
References: https://fortiguard.com/psirt/FG-IR-23-177; https://fortiguard.com/psirt/FG-IR-23-177
CVE: CVE-2023-47653
Published: 2023-11-14
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Abu Bakar TWB Woocommerce Reviews plugin <= 1.7.5 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/twb-woocommerce-reviews/wordpress-twb-woocommerce-reviews-plugin-1-7-5-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/twb-woocommerce-reviews/wordpress-twb-woocommerce-reviews-plugin-1-7-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-47654
Published: 2023-11-14
Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in livescore.Bz BZScore – Live Score plugin <= 1.03 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/bzscore-live-score/wordpress-bzscore-live-score-plugin-1-03-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/bzscore-live-score/wordpress-bzscore-live-score-plugin-1-03-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-47656
Published: 2023-11-14
Description: Auth. (editor+) Stored Cross-Site Scripting (XSS) vulnerability in Marco Milesi ANAC XML Bandi di Gara plugin <= 7.5 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/avcp/wordpress-anac-xml-bandi-di-gara-plugin-7-5-cross-site-scripting-xss-vulnerability-2?_s_id=cve; https://patchstack.com/database/vulnerability/avcp/wordpress-anac-xml-bandi-di-gara-plugin-7-5-cross-site-scripting-xss-vulnerability-2?_s_id=cve
CVE: CVE-2023-47658
Published: 2023-11-14
Description: Auth. (ShopManager+) Stored Cross-Site Scripting (XSS) vulnerability in actpro Extra Product Options for WooCommerce plugin <= 3.0.3 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/extra-product-options-for-woocommerce/wordpress-extra-product-options-for-woocommerce-plugin-3-0-3-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/extra-product-options-for-woocommerce/wordpress-extra-product-options-for-woocommerce-plugin-3-0-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-26222
Published: 2023-11-14
Description: The Web Application component of TIBCO Software Inc.'s TIBCO EBX and TIBCO Product and Service Catalog powered by TIBCO EBX contains an easily exploitable vulnerability that allows a low privileged attacker with network access to execute a stored XSS on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO EBX: versions 5.9.22 and below, versions 6.0.13 and below and TIBCO Product and Service Catalog powered by TIBCO EBX: versions 5.0.0 and below.


CVSS Score: 8.7 (HIGH)
CWE: CWE-79
References: https://www.tibco.com/services/support/advisories; https://www.tibco.com/services/support/advisories
CVE: CVE-2023-47125
Published: 2023-11-14
Description: TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions DOM processing instructions are not handled correctly. This allows bypassing the cross-site scripting mechanism of typo3/html-sanitizer. This vulnerability has been addressed in versions 1.5.3 and 2.1.4. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-79
References: https://github.com/TYPO3/html-sanitizer/commit/b8f90717251d968c49dc77f8c1e5912e2fbe0dff; https://github.com/TYPO3/html-sanitizer/security/advisories/GHSA-mm79-jhqm-9j54; https://typo3.org/security/advisory/typo3-core-sa-2023-007
CVE: CVE-2023-47126
Published: 2023-11-14
Description: TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions the login screen of the standalone install tool discloses the full path of the transient data directory (e.g. /var/www/html/var/transient/). This applies to composer-based scenarios only - “classic” non-composer installations are not affected. This issue has been addressed in version 12.4.8. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CVSS Score: 3.7 (LOW)
CWE: CWE-200
References: https://github.com/TYPO3/typo3/commit/1a735dac01ec7b337ed0d80c738caa8967dea423; https://github.com/TYPO3/typo3/security/advisories/GHSA-p2jh-95jg-2w55; https://typo3.org/security/advisory/typo3-core-sa-2023-005
CVE: CVE-2023-47127
Published: 2023-11-14
Description: TYPO3 is an open source PHP based web content management system released under the GNU GPL. In typo3 installations there are always at least two different sites. Eg. first.example.org and second.example.com. In affected versions a session cookie generated for the first site can be reused on the second site without requiring additional authentication. This vulnerability has been addressed in versions 8.7.55, 9.5.44, 10.4.41, 11.5.33, and 12.4.8. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-302, CWE-287
References: https://github.com/TYPO3/typo3/commit/535dfbdc54fd5362e0bc08d911db44eac7f64019; https://github.com/TYPO3/typo3/security/advisories/GHSA-3vmm-7h4j-69rm; https://typo3.org/security/advisory/typo3-core-sa-2023-006
CVE: CVE-2023-47384
Published: 2023-11-14
Description: MP4Box GPAC v2.3-DEV-rev617-g671976fcc-master was discovered to contain a memory leak in the function gf_isom_add_chapter at /isomedia/isom_write.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted MP4 file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401, CWE-401
References: https://github.com/gpac/gpac/issues/2672; https://github.com/gpac/gpac/issues/2672
CVE: CVE-2023-47550
Published: 2023-11-14
Description: Cross-Site Request Forgery (CSRF) vulnerability in RedNao Donations Made Easy – Smart Donations allows Stored XSS.This issue affects Donations Made Easy – Smart Donations: from n/a through 4.0.12.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/smart-donations/wordpress-donations-made-easy-smart-donations-plugin-4-0-12-cross-site-scripting-xss-vulnerability-2?_s_id=cve; https://patchstack.com/database/vulnerability/smart-donations/wordpress-donations-made-easy-smart-donations-plugin-4-0-12-cross-site-scripting-xss-vulnerability-2?_s_id=cve
CVE: CVE-2023-47554
Published: 2023-11-14
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in DenK BV Actueel Financieel Nieuws – Denk Internet Solutions plugin <= 5.1.0 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/denk-internet-solutions/wordpress-actueel-financieel-nieuws-denk-internet-solutions-plugin-5-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/denk-internet-solutions/wordpress-actueel-financieel-nieuws-denk-internet-solutions-plugin-5-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-47646
Published: 2023-11-14
Description: Auth. (Shop Manager+) Stored Cross-Site Scripting (XSS) vulnerability in CedCommerce Recently viewed and most viewed products plugin <= 1.1.1 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/recently-viewed-and-most-viewed-products/wordpress-recently-viewed-and-most-viewed-products-plugin-1-1-1-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/recently-viewed-and-most-viewed-products/wordpress-recently-viewed-and-most-viewed-products-plugin-1-1-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-34060
Published: 2023-11-14
Description: VMware Cloud Director Appliance contains an authentication bypass vulnerability in case VMware Cloud Director Appliance was upgraded to 10.5 from
an older version. On an upgraded version of VMware Cloud Director Appliance 10.5, a malicious actor with network access to the appliance can bypass login
restrictions when authenticating on port 22 (ssh) or port 5480 (appliance management console) . This bypass is not present on port 443 (VCD provider
and tenant login). On a new installation of VMware Cloud Director Appliance 10.5, the bypass is not present. VMware Cloud Director Appliance is impacted since it uses an affected version of sssd from the underlying Photon OS. The sssd issue is no longer present in versions of Photon OS that ship with sssd-2.8.1-11 or higher (Photon OS 3) or sssd-2.8.2-9 or higher (Photon OS 4 and 5).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://github.com/vmware/photon/wiki/Security-Update-3.0-687; https://github.com/vmware/photon/wiki/Security-Update-4.0-512; https://github.com/vmware/photon/wiki/Security-Update-5.0-143
CVE: CVE-2023-36007
Published: 2023-11-14
Description: Microsoft Send Customer Voice survey from Dynamics 365 Spoofing Vulnerability
CVSS Score: 7.6 (HIGH)
CWE: CWE-79
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36007; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36007
CVE: CVE-2023-36049
Published: 2023-11-14
Description: .NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability
CVSS Score: 7.6 (HIGH)
CWE: CWE-20
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36049; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36049
CVE: CVE-2023-36437
Published: 2023-11-14
Description: Azure DevOps Server Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36437; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36437
CVE: CVE-2023-46132
Published: 2023-11-14
Description: Hyperledger Fabric is an open source permissioned distributed ledger framework. Combining two molecules to one another, called "cross-linking" results in a molecule with a chemical formula that is composed of all atoms of the original two molecules. In Fabric, one can take a block of transactions and cross-link the transactions in a way that alters the way the peers parse the transactions. If a first peer receives a block B and a second peer receives a block identical to B but with the transactions being cross-linked, the second peer will parse transactions in a different way and thus its world state will deviate from the first peer. Orderers or peers cannot detect that a block has its transactions cross-linked, because there is a vulnerability in the way Fabric hashes the transactions of blocks. It simply and naively concatenates them, which is insecure and lets an adversary craft a "cross-linked block" (block with cross-linked transactions) which alters the way peers process transactions. For example, it is possible to select a transaction and manipulate a peer to completely avoid processing it, without changing the computed hash of the block. Additional validations have been added in v2.2.14 and v2.5.5 to detect potential cross-linking issues before processing blocks. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 7.1 (HIGH)
CWE: CWE-362
References: https://github.com/hyperledger/fabric/security/advisories/GHSA-v9w2-543f-h69m; https://github.com/hyperledger/fabric/security/advisories/GHSA-v9w2-543f-h69m
CVE: CVE-2023-47130
Published: 2023-11-14
Description: Yii is an open source PHP web framework. yiisoft/yii before version 1.1.29 are vulnerable to Remote Code Execution (RCE) if the application calls `unserialize()` on arbitrary user input. An attacker may leverage this vulnerability to compromise the host system. A fix has been developed for the 1.1.29 release. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 8.1 (HIGH)
CWE: CWE-502
References: https://github.com/yiisoft/yii/commit/37142be4dc5831114a375392e86d6450d4951c06; https://github.com/yiisoft/yii/security/advisories/GHSA-mw2w-2hj2-fg8q; https://owasp.org/www-community/vulnerabilities/PHP_Object_Injection
CVE: CVE-2023-47533
Published: 2023-11-14
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in wpdevart Countdown and CountUp, WooCommerce Sales Timer plugin <= 1.8.2 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/countdown-wpdevart-extended/wordpress-countdown-and-countup-woocommerce-sales-timer-plugin-1-8-2-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/countdown-wpdevart-extended/wordpress-countdown-and-countup-woocommerce-sales-timer-plugin-1-8-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-47544
Published: 2023-11-14
Description: Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Atarim Visual Website Collaboration, Feedback & Project Management – Atarim plugin <= 3.12 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/atarim-visual-collaboration/wordpress-atarim-plugin-3-11-unauthenticated-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/atarim-visual-collaboration/wordpress-atarim-plugin-3-11-unauthenticated-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-47545
Published: 2023-11-14
Description: Auth. (editor+) Stored Cross-Site Scripting (XSS) vulnerability in Fatcat Apps Forms for Mailchimp by Optin Cat – Grow Your MailChimp List plugin <= 2.5.4 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/mailchimp-wp/wordpress-forms-for-mailchimp-by-optin-cat-plugin-2-5-4-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/mailchimp-wp/wordpress-forms-for-mailchimp-by-optin-cat-plugin-2-5-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-47546
Published: 2023-11-14
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Walter Pinem OneClick Chat to Order plugin <= 1.0.4.2 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/oneclick-whatsapp-order/wordpress-oneclick-chat-to-order-plugin-1-0-4-2-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/oneclick-whatsapp-order/wordpress-oneclick-chat-to-order-plugin-1-0-4-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-47547
Published: 2023-11-14
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WPFactory Products, Order & Customers Export for WooCommerce plugin <= 2.0.7 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/export-woocommerce/wordpress-products-order-customers-export-for-woocommerce-plugin-2-0-7-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/export-woocommerce/wordpress-products-order-customers-export-for-woocommerce-plugin-2-0-7-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-47549
Published: 2023-11-14
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability on 302 response page in spider-themes EazyDocs plugin <= 2.3.3 versions.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/eazydocs/wordpress-eazydocs-plugin-2-3-3-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/eazydocs/wordpress-eazydocs-plugin-2-3-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-47627
Published: 2023-11-14
Description: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. The HTTP parser in AIOHTTP has numerous problems with header parsing, which could lead to request smuggling. This parser is only used when AIOHTTP_NO_EXTENSIONS is enabled (or not using a prebuilt wheel). These bugs have been addressed in commit `d5c12ba89` which has been included in release version 3.8.6. Users are advised to upgrade. There are no known workarounds for these issues.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-444
References: https://github.com/aio-libs/aiohttp/commit/d5c12ba890557a575c313bb3017910d7616fce3d; https://github.com/aio-libs/aiohttp/security/advisories/GHSA-gfw2-4jvh-wgfg; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FUSJVQ7OQ55RWL4XAX2F5EZ73N4ZSH6U/
CVE: CVE-2023-47630
Published: 2023-11-14
Description: Kyverno is a policy engine designed for Kubernetes. An issue was found in Kyverno that allowed an attacker to control the digest of images used by Kyverno users. The issue would require the attacker to compromise the registry that the Kyverno users fetch their images from. The attacker could then return an vulnerable image to the the user and leverage that to further escalate their position. As such, the attacker would need to know which images the Kyverno user consumes and know of one of multiple exploitable vulnerabilities in previous digests of the images. Alternatively, if the attacker has compromised the registry, they could craft a malicious image with a different digest with intentionally placed vulnerabilities and deliver the image to the user.  Users pulling their images by digests and from trusted registries are not impacted by this vulnerability. There is no evidence of this being exploited in the wild. The issue has been patched in 1.10.5. All users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 7.1 (HIGH)
CWE: CWE-345
References: https://github.com/kyverno/kyverno/security/advisories/GHSA-3hfq-cx9j-923w; https://github.com/kyverno/kyverno/security/advisories/GHSA-3hfq-cx9j-923w
CVE: CVE-2023-47631
Published: 2023-11-14
Description: vantage6 is a framework to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Multi-Party Computation (MPC). In affected versions a node does not check if an image is allowed to run if a `parent_id` is set. A malicious party that breaches the server may modify it to set a fake `parent_id` and send a task of a non-whitelisted algorithm. The node will then execute it because the `parent_id` that is set prevents checks from being run. This impacts all servers that are breached by an expert user. This vulnerability has been patched in version 4.1.2. All users are advised to upgrade. There are no known workarounds for this vulnerability.

CVSS Score: 7.2 (HIGH)
CWE: CWE-345
References: https://github.com/vantage6/vantage6/blob/version/4.1.1/vantage6-node/vantage6/node/docker/docker_manager.py#L265-L268; https://github.com/vantage6/vantage6/commit/bf83521eb12fa80aa5fc92ef1692010a9a7f8243; https://github.com/vantage6/vantage6/security/advisories/GHSA-vc3v-ppc7-v486
CVE: CVE-2023-47640
Published: 2023-11-14
Description: DataHub is an open-source metadata platform. The HMAC signature for DataHub Frontend sessions was being signed using a SHA-1 HMAC with the frontend secret key. SHA1 with a 10 byte key can be brute forced using sufficient resources (i.e. state level actors with large computational capabilities). DataHub Frontend was utilizing the Play LegacyCookiesModule with default settings which utilizes a SHA1 HMAC for signing. This is compounded by using a shorter key length than recommended by default for the signing key for the randomized secret value. An authenticated attacker (or attacker who has otherwise obtained a session token) could crack the signing key for DataHub and obtain escalated privileges by generating a privileged session cookie. Due to key length being a part of the risk, deployments should update to the latest helm chart and rotate their session signing secret. All deployments using the default helm chart configurations for generating the Play secret key used for signing are affected by this vulnerability. Version 0.11.1 resolves this vulnerability. All users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-327, CWE-327
References: https://github.com/datahub-project/datahub/security/advisories/GHSA-fg9x-wvqw-6gmw; https://github.com/datahub-project/datahub/security/advisories/GHSA-fg9x-wvqw-6gmw