GHSA-hwj7-frgj-7829 CVE-2023-1537 GO-2023-1659
Answer vulnerable to Authentication Bypass by Capture-replay
- Severity
- 9.8 / 10
- Critical · CVSS 3.1
- Exploit chance (EPSS)
- 0.84%
- Chance of exploitation in the next 30 days. Higher than 57.78% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-294 Authentication Bypass by Capture-replay
- Fix
1.0.6- Upgrade github.com/answerdev/answer to this version or later
Description
Authentication Bypass by Capture-replay in GitHub repository answerdev/answer prior to 1.0.6.
Affected versions
Go
| Package | Vulnerable | Fixed in |
|---|---|---|
| github.com/answerdev/answer | < 1.0.6 |
1.0.6 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
github.com/answerdev/answer Go → 1.0.6
- go
go get github.com/answerdev/answer@v1.0.6 && go mod tidy
Severity breakdown
CVSS 3.1 9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Weakness
CWE-294: Authentication Bypass by Capture-replay
A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).
How to prevent it
- Architecture and Design: Utilize some sequence or time stamping functionality along with a checksum which takes this into account in order to ensure that messages can be parsed only once.
- Architecture and Design: Since any attacker who can listen to traffic can see sequence numbers, it is necessary to sign messages with some kind of cryptography to ensure that sequence numbers are not simply doctored along with content.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-pj2h-85jq-g5vg Answer Missing Authentication for Critical Function | High | Also affects github.com/answerdev/answer |
| GHSA-52h8-c876-989c Answer has Race Condition within a Thread | Medium | Also affects github.com/answerdev/answer |
| GHSA-ggcf-hwxp-rc77 Answer Insufficient Session Expiration vulnerability | High | Also affects github.com/answerdev/answer |
| GHSA-j63x-f657-2m9g Answer has Weak Password Requirements | High | Also affects github.com/answerdev/answer |
| GHSA-v9vc-7x69-c2x8 Answer Missing Authorization vulnerability | Medium | Also affects github.com/answerdev/answer |
| GHSA-qmqw-r4x6-3w2q Answer Missing Authorization vulnerability | Low | Also affects github.com/answerdev/answer |
| GHSA-j97g-77fj-9c4p Answer vulnerable to account takeover because password reset links do not expire | High | Also affects github.com/answerdev/answer |
| GHSA-65v8-6pvw-jwvq Answer vulnerable to Insertion of Sensitive Information Into Sent Data | Medium | Also affects github.com/answerdev/answer |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor