Most recent entries from all

bdu:2022-06440

fkie_cve-2022-39267

Bifrost is a heterogeneous middleware that synchronizes MySQL, MariaDB to Redis, MongoDB, ClickHouse, MySQL and other services for production environments. Versions prior to 1.8.8-release are subject to authentication bypass in the admin and monitor user groups by deleting the X-Requested-With: XMLHttpRequest field in the request header. This issue has been patched in 1.8.8-release. There are no known workarounds.

GHSA-mxrx-fg8p-5p5j — Bifrost vulnerable to authentication check flaw that leads to authentication bypass

Affected: Go: github.com/brokercap/Bifrost

### Impact The admin and monitor user groups need to be authenticated by username and password. If we delete the X-Requested-With: XMLHttpRequest field in the request header,the authentication will be bypassed.

### Patches https://github.com/brockercap/Bifrost/pull/201

### Workarounds Upgrade to the latest version

Most recent entries from all

bdu:2022-06440

fkie_cve-2022-39267

GHSA-mxrx-fg8p-5p5j — Bifrost vulnerable to authentication check flaw that leads to authentication bypass

gsd-2022-39267