VulnerabilityModified
CVE-2022-39219
Versions 1.8.6-release and prior are vulnerable to authentication bypass when using HTTP basic authentication.
MEDIUM 6.5EPSS 0.98%
Does this matter?
Lower severity and a low EPSS score (0.98%). Track it; it rarely justifies an emergency change on its own.
Description
Bifrost is a middleware package which can synchronize MySQL/MariaDB binlog data to other types of databases. Versions 1.8.6-release and prior are vulnerable to authentication bypass when using HTTP basic authentication. This may allow group members who only have read permissions to write requests when they are normally forbidden from doing so. Version 1.8.7-release contains a patch. There are currently no known workarounds.
- CVSS 3.1
- 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
- EPSS
- 0.98% probability · 60th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-287
- Affected
- xbifrost/bifrost
- Source
- security-advisories@github.com
References
- https://github.com/brokercap/Bifrost/issues/200Exploit, Issue Tracking, Third Party Advisory
- https://github.com/brokercap/Bifrost/releases/tag/v1.8.7-releaseRelease Notes, Third Party Advisory
- https://github.com/brokercap/Bifrost/security/advisories/GHSA-p6fh-xc6r-g5hwThird Party Advisory
- https://github.com/brokercap/Bifrost/issues/200Exploit, Issue Tracking, Third Party Advisory
- https://github.com/brokercap/Bifrost/releases/tag/v1.8.7-releaseRelease Notes, Third Party Advisory
- https://github.com/brokercap/Bifrost/security/advisories/GHSA-p6fh-xc6r-g5hwThird Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.