CVE-2022-36089
High
Description
KubeVela is an application delivery platform Users using KubeVela's VelaUX APIServer could be affected by an authentication bypass vulnerability. In KubeVela prior to versions 1.4.11 and 1.5.4, VelaUX APIServer uses the `PlatformID` as the signed key to generate the JWT tokens for users. Another API called `getSystemInfo` exposes the platformID. This vulnerability allows users to use the platformID to re-generate the JWT tokens to bypass the authentication. Versions 1.4.11 and 1.5.4 contain a patch for this issue.
SeverityHigh
CVSS8.2
Exploit probability—
ProductKubevela
PublishedSep 7, 2022
First seenSep 7, 2022
Weakness typeCWE-294CWE-294
How to fix
Update
- kubevela kubevela1.4.11, 1.5.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| kubevela kubevela | 1.4.0 ≤ v < 1.4.11, 1.5.0 ≤ v < 1.5.3 | 1.4.11, 1.5.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.