Team IT Security (TSEC) Nachrichtenportal Logo

💾 OpenMetadata 1.2.3 Authentication Bypass / SpEL Injection


Nachrichtenbereich: 💾 IT Security Tools
🔗 Quelle: packetstormsecurity.com

This Metasploit module exploits OpenMetadata versions 1.2.3 and below by chaining an API authentication bypass using JWT tokens along with a SpEL injection vulnerability to achieve arbitrary command execution. ...

Sharing is caring on Social Media

Reddit
Telegram
LinkedIn
Xing
Twitter
Whatsapp
Facebook
Flipboard

⚠️ #0daytoday #OpenMetadata 1.2.3 Authentication Bypass / SpEL Injection Exploit [remote #exploits #0day #Exploit]


📈 65.86 Punkte
⚠️ PoC

💾 OpenMetadata 1.2.3 Authentication Bypass / SpEL Injection


📈 65.86 Punkte
💾 IT Security Tools

🕵️ CVE-2024-28255 | open-metadata OpenMetadata up to 1.2.3 /api/v1 getUserPrincipal improper authentication (GHSA-6wx7-qw5p-wh84)


📈 30.69 Punkte
🕵️ Sicherheitslücken

🕵️ CVE-2024-37759 | DataGear up to 5.0.0 SpEL Expression injection (Issue 32)


📈 29.37 Punkte
🕵️ Sicherheitslücken

🕵️ CVE-2022-22963 | VMware Spring Cloud Function up to 3.1.6/3.2.2 SpEL Expression code injection


📈 29.37 Punkte
🕵️ Sicherheitslücken

🕵️ CVE-2024-28254 | open-metadata OpenMetadata up to 1.2.3 validateExpression os command injection (GHSA-j86m-rrpr-g8gw)


📈 28.63 Punkte
🕵️ Sicherheitslücken

🕵️ CVE-2024-28847 | open-metadata OpenMetadata up to 1.2.3 validateExpression code injection (GHSA-8p5r-6mvv-2435)


📈 28.63 Punkte
🕵️ Sicherheitslücken

🕵️ CVE-2024-28848 | open-metadata OpenMetadata up to 1.2.3 validateExpression code injection (GHSA-5xv3-fm7g-865r)


📈 28.63 Punkte
🕵️ Sicherheitslücken

🕵️ CVE-2024-28253 | open-metadata OpenMetadata up to 1.3.0 validateExpression code injection (GHSA-7vf4-x5m2-r6gr)


📈 28.63 Punkte
🕵️ Sicherheitslücken

🔧 Query beans by using Spring Expression Language (SpEL)


📈 26.52 Punkte
🔧 Programmierung

🕵️ CVE-2024-38808 | Vmware Spring Framework up to 5.3.38 SpEL Expression denial of service


📈 26.52 Punkte
🕵️ Sicherheitslücken

🕵️ CVE-2023-20863 | VMware Spring Framework up to 5.2.23/5.3.26/6.0.7 SpEL Expression resource consumption


📈 26.52 Punkte
🕵️ Sicherheitslücken

🕵️ CVE-2023-20861 | VMware Spring Framework up to 5.2.22/5.3.25/6.0.6 SpEL Expression denial of service


📈 26.52 Punkte
🕵️ Sicherheitslücken

🕵️ CVE-2022-23463 | Nepxion Discovery SpEL unknown vulnerability (GHSL-2022-033)


📈 26.52 Punkte
🕵️ Sicherheitslücken

🕵️ Netflix Spinnaker up to 1.21.4/1.22.3/1.23.3 SpEL Expression deserialization


📈 26.52 Punkte
🕵️ Sicherheitslücken

🕵️ GitHub Security Lab: CodeQL query for SpEL injections


📈 26.52 Punkte
🕵️ Sicherheitslücken

📰 OpenMetadata Vulnerabilities Exploited to Abuse Kubernetes Clusters for Cryptomining  


📈 25.78 Punkte
📰 IT Security Nachrichten

📰 Attackers exploiting new critical OpenMetadata vulnerabilities on Kubernetes clusters


📈 25.78 Punkte
📰 IT Security Nachrichten

📰 Crooks exploit OpenMetadata holes to mine crypto – and leave a sob story for victims


📈 25.78 Punkte
📰 IT Security Nachrichten

📰 Hackers Exploit OpenMetadata Flaws to Mine Crypto on Kubernetes


📈 25.78 Punkte
📰 IT Security Nachrichten

📰 Hackers hijack OpenMetadata apps in Kubernetes cryptomining attacks


📈 25.78 Punkte
📰 IT Security Nachrichten

📰 How to bring custom ML Models into OpenMetadata


📈 25.78 Punkte
🔧 AI Nachrichten

🕵️ Bugtraq: [security bulletin] HPSBUX03574 rev.1 - HPE HP-UX CIFS-Server (Samba), Remote Access Restriction Bypass, Authentication bypass, Denial of Service (DoS), Unauthorized Access to Files, Access Restriction Bypass, Unauthorized Information Disclo


📈 22.3 Punkte
🕵️ Sicherheitslücken

🕵️ Bugtraq: [security bulletin] HPSBUX03574 rev.1 - HPE HP-UX CIFS-Server (Samba), Remote Access Restriction Bypass, Authentication bypass, Denial of Service (DoS), Unauthorized Access to Files, Access Restriction Bypass, Unauthorized Information Disclo


📈 22.3 Punkte
🕵️ Sicherheitslücken

🕵️ CVE-2022-0547 | OpenVPN up to 2.4.12/2.5.6 External Authentication Plug-in authentication bypass


📈 15.62 Punkte
🕵️ Sicherheitslücken

🕵️ CVE-2025-24856 | causal oidc 3.x OpenID Connect Authentication authentication bypass


📈 15.62 Punkte
🕵️ Sicherheitslücken

🕵️ Authentication bypass in the two-factor authentication


📈 15.62 Punkte
🕵️ Sicherheitslücken

🕵️ CVE-2024-47406 | Sharp/Toshiba Tec MFP HTTP Authentication authentication bypass


📈 15.62 Punkte
🕵️ Sicherheitslücken

🕵️ cPanel up to 55.9999.140 Two Factor Authentication DNS Clustering Request Bypass weak authentication


📈 15.62 Punkte
🕵️ Sicherheitslücken

🕵️ cPanel up to 55.9999.140 Two Factor Authentication DNS Clustering Request Bypass weak authentication


📈 15.62 Punkte
🕵️ Sicherheitslücken

🕵️ Vuln: EMC RSA Authentication Agent for Web: Apache Web Server Authentication Bypass Vulnerability


📈 15.62 Punkte
🕵️ Sicherheitslücken

💾 RSA Authentication Agent For Web Authentication Bypass


📈 15.62 Punkte
💾 IT Security Tools

⚠️ [webapps] - KB Login Authentication Script 1.1 - Authentication Bypass


📈 15.62 Punkte
⚠️ PoC

⚠️ [webapps] - KB Login Authentication Script 1.1 - Authentication Bypass


📈 15.62 Punkte
⚠️ PoC

🕵️ CVE-2024-5658 | Born05 Two-Factor Authentication Plugin up to 3.3.3 on CraftCMS Two-factor Authentication improper authentication


📈 14.74 Punkte
🕵️ Sicherheitslücken

matomo
•