{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2022-46145", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "requesterUserId": "c184a3d9-dc98-4c48-a45b-d2d88cf0ac74", "dateReserved": "2022-11-28T17:27:19.995Z", "datePublished": "2022-12-02T17:12:42.046Z", "dateUpdated": "2024-08-03T14:24:03.299Z"}, "containers": {"cna": {"title": "authentik vulnerable to unauthorized user creation and potential account takeover", "problemTypes": [{"descriptions": [{"cweId": "CWE-287", "lang": "en", "description": "CWE-287: Improper Authentication", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/goauthentik/authentik/security/advisories/GHSA-mjfw-54m5-fvjf", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/goauthentik/authentik/security/advisories/GHSA-mjfw-54m5-fvjf"}, {"name": "https://goauthentik.io/docs/releases/2022.10#fixed-in-2022102", "tags": ["x_refsource_MISC"], "url": "https://goauthentik.io/docs/releases/2022.10#fixed-in-2022102"}, {"name": "https://goauthentik.io/docs/releases/2022.11#fixed-in-2022112", "tags": ["x_refsource_MISC"], "url": "https://goauthentik.io/docs/releases/2022.11#fixed-in-2022112"}], "affected": [{"vendor": "goauthentik", "product": "authentik", "versions": [{"version": "< 2022.10.2", "status": "affected"}, {"version": ">= 2022.11.0, < 2022.11.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2022-12-02T17:12:42.046Z"}, "descriptions": [{"lang": "en", "value": "authentik is an open-source identity provider. Versions prior to 2022.11.2 and 2022.10.2 are vulnerable to unauthorized user creation and potential account takeover. With the default flows, unauthenticated users can create new accounts in authentik. If a flow exists that allows for email-verified password recovery, this can be used to overwrite the email address of admin accounts and take over their accounts. authentik 2022.11.2 and 2022.10.2 fix this issue. As a workaround, a policy can be created and bound to the `default-user-settings-flow flow` with the contents `return request.user.is_authenticated`."}], "source": {"advisory": "GHSA-mjfw-54m5-fvjf", "discovery": "UNKNOWN"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T14:24:03.299Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/goauthentik/authentik/security/advisories/GHSA-mjfw-54m5-fvjf", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/goauthentik/authentik/security/advisories/GHSA-mjfw-54m5-fvjf"}, {"name": "https://goauthentik.io/docs/releases/2022.10#fixed-in-2022102", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://goauthentik.io/docs/releases/2022.10#fixed-in-2022102"}, {"name": "https://goauthentik.io/docs/releases/2022.11#fixed-in-2022112", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://goauthentik.io/docs/releases/2022.11#fixed-in-2022112"}]}]}}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:goauthentik:authentik:*:*:*:*:*:*:*:*", "matchCriteriaId": "9F3DA805-D8FD-4A9A-BFA8-1641B3B9F2B0", "versionEndExcluding": "2022.10.2", "vulnerable": true}, {"criteria": "cpe:2.3:a:goauthentik:authentik:*:*:*:*:*:*:*:*", "matchCriteriaId": "7F5F2233-A097-4E2D-BABF-AE1947C45475", "versionEndExcluding": "2022.11.2", "versionStartIncluding": "2022.11", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "authentik is an open-source identity provider. Versions prior to 2022.11.2 and 2022.10.2 are vulnerable to unauthorized user creation and potential account takeover. With the default flows, unauthenticated users can create new accounts in authentik. If a flow exists that allows for email-verified password recovery, this can be used to overwrite the email address of admin accounts and take over their accounts. authentik 2022.11.2 and 2022.10.2 fix this issue. As a workaround, a policy can be created and bound to the `default-user-settings-flow flow` with the contents `return request.user.is_authenticated`."}, {"lang": "es", "value": "authentik es un proveedor de identidad de c\u00f3digo abierto. Las versiones anteriores a 2022.11.2 y 2022.10.2 son vulnerables a la creaci\u00f3n de usuarios no autorizados y a una posible apropiaci\u00f3n de cuentas. Con los flujos predeterminados, los usuarios no autenticados pueden crear nuevas cuentas en authentik. Si existe un flujo que permite la recuperaci\u00f3n de contrase\u00f1as verificadas por correo electr\u00f3nico, se puede utilizar para sobrescribir la direcci\u00f3n de correo electr\u00f3nico de las cuentas de administrador y hacerse cargo de sus cuentas. authentik 2022.11.2 y 2022.10.2 solucionan este problema. Como workaround, se puede crear una pol\u00edtica y vincularla al \"default-user-settings-flow flow\" con el contenido \"return request.user.is_authenticated\"."}], "id": "CVE-2022-46145", "lastModified": "2024-11-21T07:30:11.823", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.9, "source": "[email protected]", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "[email protected]", "type": "Primary"}]}, "published": "2022-12-02T18:15:12.790", "references": [{"source": "[email protected]", "tags": ["Mitigation", "Third Party Advisory"], "url": "https://github.com/goauthentik/authentik/security/advisories/GHSA-mjfw-54m5-fvjf"}, {"source": "[email protected]", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://goauthentik.io/docs/releases/2022.10#fixed-in-2022102"}, {"source": "[email protected]", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://goauthentik.io/docs/releases/2022.11#fixed-in-2022112"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mitigation", "Third Party Advisory"], "url": "https://github.com/goauthentik/authentik/security/advisories/GHSA-mjfw-54m5-fvjf"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://goauthentik.io/docs/releases/2022.10#fixed-in-2022102"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://goauthentik.io/docs/releases/2022.11#fixed-in-2022112"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}], "source": "[email protected]", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-306"}], "source": "[email protected]", "type": "Primary"}]}

{}