CVE-2023-25560 - CVE House
Back to Database
Status published High CVE-2023-25560

JSON Injection in DataHub

Vulnerability Description

DataHub is an open-source metadata platform. The AuthServiceClient which is responsible for creation of new accounts, verifying credentials, resetting them or requesting access tokens, crafts multiple JSON strings using format strings with user-controlled data. This means that an attacker may be able to augment these JSON strings to be sent to the backend and that can potentially be abused by including new or colliding values. This issue may lead to an authentication bypass and the creation of system accounts, which effectively can lead to full system compromise. Users are advised to upgrade. There are no known workarounds for this vulnerability. This vulnerability was discovered and reported by the GitHub Security lab and is tracked as GHSL-2022-080.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-25560

Credits & Attribution

No credits recorded in the NVD database.

References

More from datahub-project

View All →
CVE-2024-22409
Default Privileges allow for high level operations for low privileged users in datahub
High 7.5
CVE-2023-47640
Insecure Use of HMAC-SHA1 For Session Signing in datahub
Medium 6.4
CVE-2023-47629
Privilege escalation through email sign-up in datahub
High 7.1
CVE-2023-47628
Session Expiration Misconfiguration in datahub
Medium 4.2
CVE-2023-25562
Failure to Invalidate Session on Logout in DataHub
Medium 6.9

Affected Vendor

datahub-project

View all reports →

Affected Software

datahub
Vulnerable Versions:
< 0.8.45

Timeline

Official Publish: February 10th, 2023
Last Modified: March 10th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

Weaknesses (CWE)

CWE-913

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.