CVE-2022-39219CWE-287

Bifrost users using basic authntication can bypass write permission limit

High · published September 26, 2022

CVSS v3.1
8.5
EPSS
1%
Percentile
67.4
In the wild
Unconfirmed
What it is

Bifrost is a middleware package which can synchronize MySQL/MariaDB binlog data to other types of databases. Versions 1.8.6-release and prior are vulnerable to authentication bypass when using HTTP basic authentication. This may allow group members who only have read permissions to write requests when they are normally forbidden from doing so. Version 1.8.7-release contains a patch. There are currently no known workarounds.

The record
Technical detail
CVSS v3.1
8.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.01176 · 67.4th percentile
Weakness
CWE-287 · Improper Authentication
Published
2022-09-26T13:15Z
EPSS history
Timeline
  • 26 SEP 13:15Z
    Bifrost users using basic authntication can bypass write permission limit
    cvelistv5