Authentication Bypass

2022-09-0808:14:26

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

github

authentication bypass

kubevela software

0.002 Low

EPSS

Percentile

59.7%

JSON

github.com/kubevela/kubevela is vulnerable to authentication bypass. The vulnerability exists in authentication.go because the users are allowed use the platformID to re-generate the JWT tokens which allows an attacker to bypass the authentication.

CPENameOperatorVersion
github.com/kubevela/kubevelaeqv1.6.0-alpha.1
github.com/kubevela/kubevelalev1.5.2
github.com/kubevela/kubevelaeqv1.6.0-alpha.1
github.com/kubevela/kubevelalev1.5.2

Name	Operator	Version
github.com/kubevela/kubevela	eq	v1.6.0-alpha.1
github.com/kubevela/kubevela	le	v1.5.2
github.com/kubevela/kubevela	eq	v1.6.0-alpha.1
github.com/kubevela/kubevela	le	v1.5.2