Authentication Bypass

🗓️ 07 Oct 2022 03:01:46Reported by Veracode Vulnerability DatabaseType

Vulnerability in flyteadmin software for authentication bypass via hard-coded credentials

Reporter	Title	Published	Views	Family All 15
Circl	CVE-2022-39273	6 Oct 202222:17	–	circl
CNNVD	FlyteAdmin 信任管理问题漏洞	6 Oct 202200:00	–	cnnvd
CNVD	WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. An information disclosure vulnerability exists in WordPress WP Cerber Security 9.0 and prior versions, which stems from incorrect validation of the value provided for the author parameter in the ~/cerber-load.php file. An attacker can exploit the vulnerability to launch a user enumeration attack.	10 Oct 202200:00	–	cnvd
CVE	CVE-2022-39273	6 Oct 202200:00	–	cve
Cvelist	CVE-2022-39273 Default OAuth Authorization Server secret in FlyteAdmin	6 Oct 202200:00	–	cvelist
EUVD	EUVD-2022-7035	3 Oct 202520:07	–	euvd
Github Security Blog	FlyteAdmin's Default OAuth Authorization Server secret must be rotated	5 Oct 202221:26	–	github
NVD	CVE-2022-39273	6 Oct 202218:16	–	nvd
OSV	CVE-2022-39273 Default OAuth Authorization Server secret in FlyteAdmin	6 Oct 202200:00	–	osv
OSV	GHSA-67X4-QR35-QVRM FlyteAdmin's Default OAuth Authorization Server secret must be rotated	5 Oct 202221:26	–	osv

Vulners

Node

Source	Link
github	www.github.com/flyteorg/flyteadmin/pull/478
github	www.github.com/flyteorg/flyteadmin/commit/281172edf55fe6800959238fc128964ead6d9101
github	www.github.com/advisories/GHSA-67x4-qr35-qvrm
docs	www.docs.flyte.org/en/latest/deployment/cluster_config/auth_setup.html
github	www.github.com/flyteorg/flyteadmin/security/advisories/GHSA-67x4-qr35-qvrm
cve	www.cve.org/CVERecord

11 Oct 2022 06:21Current

3.3Low risk

Vulners AI Score3.3

CVSS 3.14.8 - 7.5

EPSS0.00268