Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2023-51982

Date: January 29, 2024

CrateDB 5.5.1 is contains an authentication bypass vulnerability in the Admin UI component. After configuring password authentication and_ Local_ In the case of an address, identity authentication can be bypassed by setting the X-Real IP request header to a specific value and accessing the Admin UI directly using the default user identity.(https://github.com/crate/crate/issues/15231)

Language: Java

Severity Score

Related Resources (11)

https://github.com/crate/crate-python/commit/813946b9420d45877ef7c369311dbc8804d6674f
https://github.com/crate/crate/issues/15231
https://github.com/pypa/advisory-database/tree/main/vulns/crate/PYSEC-2024-27.yaml
https://github.com/crate/crate/commit/0c166ef083bec4d64dd55c1d8cb9b3dec350d241
https://nvd.nist.gov/vuln/detail/CVE-2023-51982
https://github.com/crate/crate
https://github.com/crate/crate/commit/b8b4cec49a1c7eb2b5af568400bd571d194dc03e
https://github.com/crate/crate/pull/15234
https://github.com/crate/crate/commit/da59311ca920743ebc58ee64c29cfe5723487f56
https://github.com/crate/crate/commit/5be7b3864137c23305ece10df3f7c311ee50ae4d
https://www.mend.io/vulnerability-database/CVE-2023-51982

Severity Score

Weakness Type (CWE)

Improper Authentication

CWE-287

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): HIGH
Integrity (I): HIGH
Availability (A): HIGH

Do you need more information?

Contact Us