CVE-2023-47629

DataHub is an open-source metadata platform. In affected versions sign-up through an invite link does not properly restrict users from signing up as privileged accounts. If a user is given an email sign-up link they can potentially create an admin account given certain preconditions. If the defau...

CVE-2023-47629 Privilege escalation through email sign-up in datahub

DataHub is an open-source metadata platform. In affected versions sign-up through an invite link does not properly restrict users from signing up as privileged accounts. If a user is given an email sign-up link they can potentially create an admin account given certain preconditions. If the defau...

CVE-2023-47629

Summary: CVE-2023-47629 affects DataHub, where sign-up via an invite link can let a user create an admin account under certain preconditions, if the default DataHub user was removed but default policies remain. This can enable privilege escalation to admin level on affected installations. Affecte...

CVE-2023-47629 Privilege escalation through email sign-up in datahub

DataHub is an open-source metadata platform. In affected versions sign-up through an invite link does not properly restrict users from signing up as privileged accounts. If a user is given an email sign-up link they can potentially create an admin account given certain preconditions. If the defau...

CVE-2023-47629 Privilege escalation through email sign-up in datahub

DataHub is an open-source metadata platform. In affected versions sign-up through an invite link does not properly restrict users from signing up as privileged accounts. If a user is given an email sign-up link they can potentially create an admin account given certain preconditions. If the defau...

DataHub Security Breach

DataHub is datahub-project open source metadata platform for a modern data stack. A security vulnerability exists in DataHub versions prior to v0.11.1 that stems from the insecure use of HMAC-SHA1 for session signing, which can be exploited by an attacker to brute-force crack...

PT-2023-30529 · Datahub · Datahub

Name of the Vulnerable Software and Affected Versions: DataHub versions prior to 0.11.1 Description: The issue concerns the use of a SHA-1 HMAC with a short key length for signing session tokens in DataHub Frontend, making it vulnerable to brute force attacks by sufficiently resourced actors. An...

CVE-2023-47640: Use of a Broken or Risky Cryptographic Algorithm

DataHub is an open-source metadata platform. The HMAC signature for DataHub Frontend sessions was being signed using a SHA-1 HMAC with the frontend secret key. SHA1 with a 10 byte key can be brute forced using sufficient resources i.e. state level actors with large computational capabilities...

CVE-2023-47628: Insufficient Session Expiration

DataHub is an open-source metadata platform. DataHub Frontend's sessions are configured using Play Framework's default settings for stateless session which do not set an expiration time for a cookie. Due to this, if a session cookie were ever leaked, it would be valid forever. DataHub uses a...

CVE-2023-47629: Improper Privilege Management

DataHub is an open-source metadata platform. In affected versions sign-up through an invite link does not properly restrict users from signing up as privileged accounts. If a user is given an email sign-up link they can potentially create an admin account given certain preconditions. If the defau...

PT-2023-30523 · Datahub · Datahub

Name of the Vulnerable Software and Affected Versions: DataHub versions prior to 0.12.1 Description: The issue concerns an open-source metadata platform where sign-up through an invite link does not properly restrict users from signing up as privileged accounts. If a user is given an email sign-u...

DataHub Security Breach

DataHub is an open source metadata platform for modern data stacks from datahub-project. A security vulnerability exists in versions of DataHub prior to 0.12.1 that stems from allowing an attacker to register an administrator account via an email invitation link...

PT-2023-30522

Name of the Vulnerable Software and Affected Versions DataHub versions prior to 0.12.1 Description DataHub is an open-source metadata platform. The issue arises from the configuration of DataHub Frontend's sessions using Play Framework's default settings for stateless sessions, which do not set a...

DataHub Code Issue Vulnerability

DataHub is datahub-project open source metadata platform for a modern data stack. A code issue vulnerability exists in DataHub versions prior to 0.11.1, which stems from the DataHub front-end not setting a cookie expiration time, resulting in the cookie being permanently valid after an attacker...

acryl-datahub (>=0.8.24.2, <=0.11.0.6rc1), acryl-datahub-actions (>=0.0.1rc4, <=0.0.8) +28 more potentially affected by CVE-2023-39410 via avro (>=1.8.2, <=1.11.2)

avro PYPI version =1.8.2, =0.8.24.2, =0.0.1rc4, =0.9.2.2rc0, =0.0.1, =1.0.0b4, =0.9.15, =0.0.2, =0.2.78, =0.15.8, =0.1.0, =0.1.0, =0.3.0, =0.5.0rc1, =0.1.0, =1.1.1 and more Source cves: CVE-2023-39410 Source advisory: OSV:PYSEC-2023-188...

acryl-datahub-gx-plugin (>=0.14.0.3rc1, <=1.1.1rc4), aepsych (>=0.3.0, <=0.4.0) +202 more potentially affected by CVE-2023-40170 via jupyter-server (1.24.0)

jupyter-server PYPI version 1.24.0 is affected by a known vulnerability. The following packages have a transitive dependency on jupyter-server and may be impacted: - acryl-datahub-gx-plugin =0.14.0.3rc1, =0.3.0, =0.1.0b0, =0.1.0, =0.2.2, =0.0.2, =0.0.2, =0.1.0, =0.2.0, =0.3.0 -...

abi-ds-utils (1.0.1), acryl-datahub-airflow-plugin (>=0.8.44.4rc1, <=0.11.0) +31 more potentially affected by CVE-2023-40273 via apache-airflow (>=2.0.0rc3, <=2.6.3)

apache-airflow PYPI version =2.0.0rc3, =0.8.44.4rc1, =0.1.0rc3, =0.2.9b1, =0.6.0, =0.2.0, =0.0.3, =0.0.6, =0.0.1, =0.0.4rc1, =0.0.0, =0.1.0, =0.2.0 and more Source cves: CVE-2023-40273 Source advisory: OSV:PYSEC-2023-158...

acryl-datahub-airflow-plugin (>=0.8.44.4rc1, <=0.9.2.1), airflow-add-ons (0.2.9b2) +16 more potentially affected by CVE-2023-34110 via flask-appbuilder (3.4.5)

flask-appbuilder PYPI version 3.4.5 is affected by a known vulnerability. The following packages have a transitive dependency on flask-appbuilder and may be impacted: - acryl-datahub-airflow-plugin =0.8.44.4rc1, =0.6.0, =0.2.0, =0.0.3, =0.0.6, =0.0.1, =2.0.2rc1, =0.0.4rc1, =0.0.0, =0.5.2, =0.8.3a...

abi-ds-utils (1.0.1), acryl-datahub-airflow-plugin (>=0.8.44.4rc1, <=0.11.0) +135 more potentially affected by CVE-2023-34110 via flask-appbuilder (>=1.10.0, <=4.3.1)

flask-appbuilder PYPI version =1.10.0, =0.8.44.4rc1, =0.1.0rc3, =2022.9.19, =0.2.9b1, =1.0.7, =0.5.1, =0.2.0, =0.1.0, =1.0.0, =0.0.7, =0.0.1, =0.0.3, =0.0.6, =0.0.8 and more Source cves: CVE-2023-34110 Source advisory: MEND:CVE-2023-34110...

abi-ds-utils (1.0.1), acryl-datahub-airflow-plugin (>=0.10.5.2rc3, <=0.11.0) +14 more potentially affected by CVE-2023-34110 via flask-appbuilder (>=4.1.2, <=4.3.1)

flask-appbuilder PYPI version =4.1.2, =0.10.5.2rc3, =0.8.2, =2.3.3rc1, =0.1.0, =0.1.20, =2.3.0.dev0, =0.0.37, =0.1.2, =2.4.3, =0.2.0, =0.2.1 and more Source cves: CVE-2023-34110 Source advisory: GHSA-JHPR-J7CQ-3JP3...