FlyteAdmin's Default OAuth Authorization Server secret must be rotated

🗓️ 05 Oct 2022 21:26:26Reported by GitHub Advisory DatabaseType

github

github🔗 github.com👁 28 Views

FlyteAdmin Default OAuth Authorization Server secret rotation require

Reporter	Title	Published	Views	Family All 15
Circl	CVE-2022-39273	6 Oct 202222:17	–	circl
CNNVD	FlyteAdmin 信任管理问题漏洞	6 Oct 202200:00	–	cnnvd
CNVD	WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. An information disclosure vulnerability exists in WordPress WP Cerber Security 9.0 and prior versions, which stems from incorrect validation of the value provided for the author parameter in the ~/cerber-load.php file. An attacker can exploit the vulnerability to launch a user enumeration attack.	10 Oct 202200:00	–	cnvd
CVE	CVE-2022-39273	6 Oct 202200:00	–	cve
Cvelist	CVE-2022-39273 Default OAuth Authorization Server secret in FlyteAdmin	6 Oct 202200:00	–	cvelist
EUVD	EUVD-2022-7035	3 Oct 202520:07	–	euvd
NVD	CVE-2022-39273	6 Oct 202218:16	–	nvd
OSV	CVE-2022-39273 Default OAuth Authorization Server secret in FlyteAdmin	6 Oct 202200:00	–	osv
OSV	GHSA-67X4-QR35-QVRM FlyteAdmin's Default OAuth Authorization Server secret must be rotated	5 Oct 202221:26	–	osv
OSV	GO-2022-1043 Hardcoded hashed password in github.com/flyteorg/flyteadmin	31 Oct 202217:09	–	osv

Vulners

Node

flyteorg flyteadminRange<1.1.44go

Source	Link
github	www.github.com/flyteorg/flyteadmin/security/advisories/GHSA-67x4-qr35-qvrm
github	www.github.com/flyteorg/flyteadmin/pull/478
docs	www.docs.flyte.org/en/latest/deployment/cluster_config/auth_setup.html
nvd	www.nvd.nist.gov/vuln/detail/CVE-2022-39273
pkg	www.pkg.go.dev/vuln/GO-2022-1043
github	www.github.com/flyteorg/flyteadmin/commit/281172edf55fe6800959238fc128964ead6d9101
github	www.github.com/advisories/GHSA-67x4-qr35-qvrm

20 May 2024 21:35Current

7.4High risk

Vulners AI Score7.4

CVSS 3.14.8 - 7.5

EPSS0.00268

flyteadmin default oauth authorization server secret rotation public exposure authentication vulnerability patches workarounds flyte configuration externalauthorizationserver selfauthserver github email support