Security Advisory

CVE-2022-36089

CVE vulnerability detail — eXtreme Datacenter Security Operations

Published 2022-09-07 23:00:15

Last updated 2025-04-23 17:13:19

Assigner GitHub_M

State PUBLISHED

Description

KubeVela is an application delivery platform Users using KubeVelas VelaUX APIServer could be affected by an authentication bypass vulnerability. In KubeVela prior to versions 1.4.11 and 1.5.4, VelaUX APIServer uses the `PlatformID` as the signed key to generate the JWT tokens for users. Another API called `getSystemInfo` exposes the platformID. This vulnerability allows users to use the platformID to re-generate the JWT tokens to bypass the authentication. Versions 1.4.11 and 1.5.4 contain a patch for this issue.

← Browse all CVEs View on cve.org ↗