CVE-2022-46145

Severity CVSS v4.0:

Pending analysis

Type:

CWE-306 Missing Authentication for Critical Function

Publication date:

02/12/2022

Last modified:

23/06/2023

Description

authentik is an open-source identity provider. Versions prior to 2022.11.2 and 2022.10.2 are vulnerable to unauthorized user creation and potential account takeover. With the default flows, unauthenticated users can create new accounts in authentik. If a flow exists that allows for email-verified password recovery, this can be used to overwrite the email address of admin accounts and take over their accounts. authentik 2022.11.2 and 2022.10.2 fix this issue. As a workaround, a policy can be created and bound to the `default-user-settings-flow flow` with the contents `return request.user.is_authenticated`.

Impact

Vector 3.x

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS v3.1 Severity and Metrics:

Base Score: 9.80 CRITICAL
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope (S): Unchanged
Confidentiality (C): High
Integrity (I): High
Availability (A): High

Base Score 3.x

9.80

Severity 3.x

CRITICAL

Vulnerable products and versions

CPE	From	Up to
cpe:2.3:a:goauthentik:authentik::::::::		2022.10.2 (excluding)
cpe:2.3:a:goauthentik:authentik::::::::	2022.11 (including)	2022.11.2 (excluding)

To consult the complete list of CPE names with products and versions, see this page

CVE-2022-46145

Description

Impact

Vulnerable products and versions

References to Advisories, Solutions, and Tools