GitHub Advisoryadvisory · Go

GHSA-mxrx-fg8p-5p5j Bifrost vulnerable to authentication check flaw that leads to authentication bypass

HIGH Published 2022-10-18 Modified 2022-10-21 Official page ↗
Aliases
CVE-2022-39267
Ecosystem
Go
Packages
github.com/brokercap/Bifrost
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-287
Reviewed
2022-10-18

Affected packages

• Go github.com/brokercap/Bifrost: < 1.8.7-release → fixed in 1.8.7-release

Description

Impact The admin and monitor user groups need to be authenticated by username and password. If we delete the X-Requested-With: XMLHttpRequest field in the request header,the authentication will be bypassed. Patches https://github.com/brockercap/Bifrost/pull/201 Workarounds Upgrade to the latest version

Related

Alias · CVE (1)

  • CVE-2022-39267 Bifrost is a heterogeneous middleware that synchronizes MySQL, MariaDB to Redis, MongoDB, ClickHouse, MySQL and other services for… vulnerability

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References