Kurz gesagt
- CVE-2023-51982 ist eine Schwachstelle (KRITISCH (CVSS 9.8)) in io.crate:crate, cratedb (cratedb).
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.73%, höher als bei 54.5% aller Schwachstellen.
- Abhilfe: auf 5.3.8, 5.4.7, 5.5.2, 5.2.11 oder neuer aktualisieren.
| Package | Affected versions | Patched versions |
|---|
| io.crate:crate Maven | ≥ 5.3.0, < 5.3.8≥ 5.4.0, < 5.4.7≥ 5.5.0, < 5.5.2< 5.2.11
| 5.3.85.4.75.5.25.2.11
|
| cratedb | = 5.5.1
| No fix yet |
Description
CrateDB 5.5.1 is contains an authentication bypass vulnerability in the Admin UI component. After configuring password authentication and_ Local_ In the case of an address, identity authentication can be bypassed by setting the X-Real IP request header to a specific value and accessing the Admin UI directly using the default user identity.
NVD description
CrateDB 5.5.1 is contains an authentication bypass vulnerability in the Admin UI component. After configuring password authentication and_ Local_ In the case of an address, identity authentication can be bypassed by setting the X-Real IP request header to a specific value and accessing the Admin UI directly using the default user identity.(https://github.com/crate/crate/issues/15231)
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free