Vulnerability · Published Feb 10, 2023 · Assigned by GitHub_M
CVE-2023-25562Failure to Invalidate Session on Logout in DataHub
Medium 6.9
In plain English
A medium-severity security flaw in datahub from datahub-project. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities).
Official description
DataHub is an open-source metadata platform. In versions of DataHub prior to 0.8.45 Session cookies are only cleared on new sign-in events and not on logout events. Any authentication checks using the `AuthUtils.hasValidSessionCookie()` method could be bypassed by using a cookie from a logged out session, as a result any logged out session cookie may be accepted as valid and therefore lead to an authentication bypass to the system. Users are advised to upgrade. There are no known workarounds for this issue. This vulnerability was discovered and reported by the GitHub Security lab and is tracked as GHSL-2022-083.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| datahub-project | datahub | < 0.8.45 |
Weakness: CWE-613 · Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N