Vulnerability · Published Oct 19, 2022 · Assigned by GitHub_M
CVE-2022-39267Brokercap Bifrost vulnerable to authentication bypass for admin and monitor user groups
High 8.8
In plain English
A high-severity improper authentication in Bifrost from brokercap. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 60% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Bifrost is a heterogeneous middleware that synchronizes MySQL, MariaDB to Redis, MongoDB, ClickHouse, MySQL and other services for production environments. Versions prior to 1.8.8-release are subject to authentication bypass in the admin and monitor user groups by deleting the X-Requested-With: XMLHttpRequest field in the request header. This issue has been patched in 1.8.8-release. There are no known workarounds.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/brokercap/Bifrost | 1.8.7-release | GO-2022-1067 |
| Go | github.com/brokercap/Bifrost | 1.8.7-release | GHSA-mxrx-fg8p-5p5j |
Affected products (as reported)
Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H