Lucene search

GitHub Advisory DatabaseGHSA-Q6J2-G8QF-WVF7

HistoryOct 12, 2021 - 10:34 p.m.

Verification check bypass in Gate One

2021-10-1222:34:28

CWE-290

GitHub Advisory Database

github.com

gate one

verification bypass

origins list

hosts

software

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

EPSS

0.001

Percentile

48.6%

JSON

An issue in Gate One 1.2.0 allows attackers to bypass to the verification check done by the origins list and connect to Gate One instances used by hosts not on the origins list.

Affected configurations

Vulners

Node

liftoffsoftwaregateoneRange≤1.2.0

VendorProductVersionCPE
liftoffsoftwaregateone*cpe:2.3:a:liftoffsoftware:gateone:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
liftoffsoftware	gateone	*	cpe:2.3:a:liftoffsoftware:gateone::::::::

References

github.com/advisories/GHSA-q6j2-g8qf-wvf7

github.com/liftoff/GateOne/issues/728

github.com/pypa/advisory-database/tree/main/vulns/gateone/PYSEC-2021-423.yaml

nvd.nist.gov/vuln/detail/CVE-2020-19003

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

EPSS

0.001

Percentile

48.6%

JSON

Related for GHSA-Q6J2-G8QF-WVF7