published November 5, 2021
🚨 A sneaky flaw allows any user from your SAML/OAuth provider to log in using any password on Talend Data Catalog! ⚠️ Think of a guest list at an exclusive event where any name can let you through the door, regardless of whether they actually belong there—an invitation that anyone can misuse! An attacker could easily bypass authentication and gain unauthorized access, potentially leading to sensitive data exposure or manipulation. This flaw could turn your data catalog into an open book for anyone with a valid SAML/OAuth username, putting your data at serious risk.
Think of a guest list at an exclusive event where any name can let you through the door, regardless of whether they actually belong there—an invitation that anyone can misuse! This vulnerability arises from improper enforcement of authentication on the native login page after setting up SAML/OAuth, allowing anyone with a valid username to login with any password.
An attacker could easily bypass authentication and gain unauthorized access, potentially leading to sensitive data exposure or manipulation. This flaw could turn your data catalog into an open book for anyone with a valid SAML/OAuth username, putting your data at serious risk. To secure your Talend Data Catalog, patch to version 7.3-20210930 or later immediately. Additionally, review your SAML/OAuth configurations and ensure that proper authentication checks are enforced on every login attempt to prevent unauthorized access. You've got this! Secure your setup and lock those doors like the security hero you are! 🛡️