Lucene search
PRIOn knowledge basePRION:CVE-2022-36089HistorySep 07, 2022 - 11:15 p.m.
Authentication flaw
2022-09-0723:15:00
PRIOn knowledge base
www.prio-n.com
8
kubevela
authentication
bypass
velaux apiserver
vulnerability
platformid
jwt tokens
getsysteminfo
patch
versions 1.4.11
1.5.4
KubeVela is an application delivery platform Users using KubeVela’s VelaUX APIServer could be affected by an authentication bypass vulnerability. In KubeVela prior to versions 1.4.11 and 1.5.4, VelaUX APIServer uses the PlatformID as the signed key to generate the JWT tokens for users. Another API called getSystemInfo exposes the platformID. This vulnerability allows users to use the platformID to re-generate the JWT tokens to bypass the authentication. Versions 1.4.11 and 1.5.4 contain a patch for this issue.
Related
cvelist
cvelist
cve
cve
CVE-2022-36089
2022-09-07 23:15:14
osv
osv
CVE-2022-36089
2022-09-07 23:15:14
nvd
nvd
CVE-2022-36089
2022-09-07 23:15:14
veracode
veracode
Authentication Bypass
2022-09-08 08:14:26