CVE-2023-47628
CVSS 3.1 Score 4.2 of 10 (medium)
Details
Summary
CVE-2023-47628 is a vulnerability that affects DataHub, an open-source metadata platform. The vulnerability exists in DataHub Frontend's sessions, where the stateless session cookies do not have an expiration time set. This means that if a session cookie is leaked, it remains valid indefinitely. Although the session cookie is removed upon logout, if an attacker obtains the cookie of an authenticated user, they can continue to use it. This vulnerability affects all DataHub instances prior to version 0.12.1. To remediate this issue, users are advised to update to the latest version which addresses the vulnerability. The potential danger of this vulnerability lies in unauthorized access and potential data breaches if an attacker gains access to a valid session cookie.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions