← Volver a CVEs
CVE-2023-22495
CRITICAL9.8
Descripcion
Izanami is a shared configuration service well-suited for micro-service architecture implementation. Attackers can bypass the authentication in this application when deployed using the official Docker image. Because a hard coded secret is used to sign the authentication token (JWT), an attacker could compromise another instance of Izanami. This issue has been patched in version 1.11.0.
Detalles CVE
Puntuacion CVSS v3.19.8
SeveridadCRITICAL
Vector CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vector de ataqueNETWORK
ComplejidadLOW
Privilegios requeridosNONE
Interaccion usuarioNONE
Publicado1/14/2023
Ultima modificacion11/21/2024
Fuentenvd
Avistamientos honeypot0
Productos afectados
maif:izanami
Debilidades (CWE)
CWE-288CWE-798
Referencias
https://github.com/MAIF/izanami/releases/tag/v1.11.0(security-advisories@github.com)
https://github.com/MAIF/izanami/security/advisories/GHSA-9r7j-m337-792c(security-advisories@github.com)
https://github.com/MAIF/izanami/releases/tag/v1.11.0(af854a3a-2127-422b-91ae-364da2661108)
https://github.com/MAIF/izanami/security/advisories/GHSA-9r7j-m337-792c(af854a3a-2127-422b-91ae-364da2661108)
Correlaciones IOC
Sin correlaciones registradas
This product uses data from the NVD API but is not endorsed or certified by the NVD.