CVE-2023-47628
CVSS 3.1 Score 4.8 of 10 (medium)
Details
Summary
CVE-2023-47628 is a vulnerability affecting DataHub, an open-source metadata platform. The issue lies in the DataHub Frontend's configuration of stateless sessions using Play Framework's default settings, which do not set an expiration time for session cookies. Consequently, if a session cookie is leaked, it remains valid indefinitely, posing a significant security risk. DataHub uses a stateless session cookie that is not invalidated upon logout, instead, it is merely removed from the browser, compelling users to re-login. While there is no validation on the session token's time window, this vulnerability arises due to the combination of LegacyCookiesModule from Play Framework and the default settings. Affected DataHub installations include those that have removed the datahub user but not the default policies tied to that user. Users are advised to upgrade to version 0.12.1 to address this issue, and no known workarounds exist for this vulnerability.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Affected Products
- Datahub Project Datahub
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions