Cloud Vulnerability DB
A community-led vulnerabilities database
Vulnerability DatabaseCVE-2022-39267
CVE-2022-39267:
vulnerability analysis and mitigation
Overview
Bifrost, a heterogeneous middleware that synchronizes MySQL and MariaDB to various services including Redis, MongoDB, ClickHouse, and MySQL, was found to contain an authentication bypass vulnerability in versions prior to 1.8.8-release. The vulnerability, identified as CVE-2022-39267, was discovered and disclosed in October 2022. The vulnerability affects the admin and monitor user groups authentication mechanism (MITRE CVE, GitHub Advisory).
Technical details
The vulnerability stems from an authentication check flaw where the authentication mechanism could be bypassed by simply removing the X-Requested-With: XMLHttpRequest field from the request header. This vulnerability is classified as CWE-287 (Improper Authentication) and has been assigned a high severity rating (GitHub Advisory).
Impact
The vulnerability allows unauthorized users to bypass authentication controls for admin and monitor user groups, potentially gaining administrative access to the Bifrost middleware system. This could lead to unauthorized access to sensitive data and system controls (GitHub Advisory).
Mitigation and workarounds
The vulnerability has been patched in version 1.8.8-release. Users are strongly advised to upgrade to this version or later as there are no known workarounds for this security issue (GitHub Advisory).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Additional Wiz resources
Get a personalized demo
Ready to see Wiz in action?
"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management