CVE-2022-36089

 

Published at: - 08-09-2022 01:15

Last modified: - 08-09-2022 03:28

Total changes: - 2

Description

KubeVela is an application delivery platform Users using KubeVela's VelaUX APIServer could be affected by an authentication bypass vulnerability. In KubeVela prior to versions 1.4.11 and 1.5.4, VelaUX APIServer uses the `PlatformID` as the signed key to generate the JWT tokens for users. Another API called `getSystemInfo` exposes the platformID. This vulnerability allows users to use the platformID to re-generate the JWT tokens to bypass the authentication. Versions 1.4.11 and 1.5.4 contain a patch for this issue.

Common Vulnerability Scoring System (CVSS)

-

 

Verification logic

 

Reference

• https://github.com/kubevela/kubevela/pull/4634
• https://github.com/kubevela/kubevela/security/advisories/GHSA-cq42-w295-r29q

 

Keywords

NVD

 

CVE-2022-36089

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures