CVE-2023-25561

Login fail open on JAAS misconfiguration in DataHub

Description

DataHub is an open-source metadata platform. In the event a system is using Java Authentication and Authorization Service (JAAS) authentication and that system is given a configuration which contains an error, the authentication for the system will fail open and allow an attacker to login using any username and password. The reason for this is that while an error is thrown in the `authenticateJaasUser` method it is swallowed without propagating the error. As a result of this issue unauthenticated users may gain access to the system. Users are advised to upgrade. There are no known workarounds for this issue. This vulnerability was discovered and reported by the GitHub Security lab and is tracked as GHSL-2022-081.

Category

5.7
CVSS
Severity: Medium
CVSS 3.1 •
EPSS 0.14%
Vendor Advisory github.com
Affected: datahub-project datahub
Published at:
Updated at:

References

Link Tags
https://github.com/datahub-project/datahub/security/advisories/GHSA-7wc6-p6c4-522c vendor advisory
https://github.com/datahub-project/datahub/blob/fdf4e48495f083314f59c414bcc7c2601633a2b8/datahub-frontend/app/security/AuthenticationManager.java#L26 issue tracking

Frequently Asked Questions

What is the severity of CVE-2023-25561?
CVE-2023-25561 has been scored as a medium severity vulnerability.
How to fix CVE-2023-25561?
To fix CVE-2023-25561, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2023-25561 being actively exploited in the wild?
As for now, there are no information to confirm that CVE-2023-25561 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2023-25561?
CVE-2023-25561 affects datahub-project datahub.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.