CVE-2023-46249 (GCVE-0-2023-46249)
Vulnerability from cvelistv5
Published
2023-10-31 15:20
Modified
2024-09-05 15:55
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-287 - Improper Authentication
Summary
authentik is an open-source Identity Provider. Prior to versions 2023.8.4 and 2023.10.2, when the default admin user has been deleted, it is potentially possible for an attacker to set the password of the default admin user without any authentication. authentik uses a blueprint to create the default admin user, which can also optionally set the default admin users' password from an environment variable. When the user is deleted, the `initial-setup` flow used to configure authentik after the first installation becomes available again. authentik 2023.8.4 and 2023.10.2 fix this issue. As a workaround, ensure the default admin user (Username `akadmin`) exists and has a password set. It is recommended to use a very strong password for this user, and store it in a secure location like a password manager. It is also possible to deactivate the user to prevent any logins as akadmin.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| goauthentik | authentik |
Version: < 2023.8.4 Version: >= 2023.10.0, < 2023.10.2 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T20:37:40.163Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/goauthentik/authentik/security/advisories/GHSA-rjvp-29xq-f62w",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/goauthentik/authentik/security/advisories/GHSA-rjvp-29xq-f62w"
},
{
"name": "https://github.com/goauthentik/authentik/commit/261879022d25016d58867cf1f24e90b81ad618d0",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/goauthentik/authentik/commit/261879022d25016d58867cf1f24e90b81ad618d0"
},
{
"name": "https://github.com/goauthentik/authentik/commit/ea75741ec22ecef34bc7073f1163e17a8a2bf9fc",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/goauthentik/authentik/commit/ea75741ec22ecef34bc7073f1163e17a8a2bf9fc"
},
{
"name": "https://github.com/goauthentik/authentik/releases/tag/version%2F2023.10.2",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/goauthentik/authentik/releases/tag/version%2F2023.10.2"
},
{
"name": "https://github.com/goauthentik/authentik/releases/tag/version%2F2023.8.4",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/goauthentik/authentik/releases/tag/version%2F2023.8.4"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:a:goauthentik:authentik:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "authentik",
"vendor": "goauthentik",
"versions": [
{
"lessThan": "2023.10.2",
"status": "affected",
"version": "2023.10.0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-46249",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-05T15:53:19.845105Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-05T15:55:53.846Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "authentik",
"vendor": "goauthentik",
"versions": [
{
"status": "affected",
"version": "\u003c 2023.8.4"
},
{
"status": "affected",
"version": "\u003e= 2023.10.0, \u003c 2023.10.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "authentik is an open-source Identity Provider. Prior to versions 2023.8.4 and 2023.10.2, when the default admin user has been deleted, it is potentially possible for an attacker to set the password of the default admin user without any authentication. authentik uses a blueprint to create the default admin user, which can also optionally set the default admin users\u0027 password from an environment variable. When the user is deleted, the `initial-setup` flow used to configure authentik after the first installation becomes available again. authentik 2023.8.4 and 2023.10.2 fix this issue. As a workaround, ensure the default admin user (Username `akadmin`) exists and has a password set. It is recommended to use a very strong password for this user, and store it in a secure location like a password manager. It is also possible to deactivate the user to prevent any logins as akadmin."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.7,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287: Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-10-31T15:20:35.166Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/goauthentik/authentik/security/advisories/GHSA-rjvp-29xq-f62w",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/goauthentik/authentik/security/advisories/GHSA-rjvp-29xq-f62w"
},
{
"name": "https://github.com/goauthentik/authentik/commit/261879022d25016d58867cf1f24e90b81ad618d0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/goauthentik/authentik/commit/261879022d25016d58867cf1f24e90b81ad618d0"
},
{
"name": "https://github.com/goauthentik/authentik/commit/ea75741ec22ecef34bc7073f1163e17a8a2bf9fc",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/goauthentik/authentik/commit/ea75741ec22ecef34bc7073f1163e17a8a2bf9fc"
},
{
"name": "https://github.com/goauthentik/authentik/releases/tag/version%2F2023.10.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/goauthentik/authentik/releases/tag/version%2F2023.10.2"
},
{
"name": "https://github.com/goauthentik/authentik/releases/tag/version%2F2023.8.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/goauthentik/authentik/releases/tag/version%2F2023.8.4"
}
],
"source": {
"advisory": "GHSA-rjvp-29xq-f62w",
"discovery": "UNKNOWN"
},
"title": "authentik potential installation takeover when default admin user is deleted"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2023-46249",
"datePublished": "2023-10-31T15:20:35.166Z",
"dateReserved": "2023-10-19T20:34:00.948Z",
"dateUpdated": "2024-09-05T15:55:53.846Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2023-46249\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2023-10-31T16:15:09.853\",\"lastModified\":\"2024-11-21T08:28:09.997\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"authentik is an open-source Identity Provider. Prior to versions 2023.8.4 and 2023.10.2, when the default admin user has been deleted, it is potentially possible for an attacker to set the password of the default admin user without any authentication. authentik uses a blueprint to create the default admin user, which can also optionally set the default admin users\u0027 password from an environment variable. When the user is deleted, the `initial-setup` flow used to configure authentik after the first installation becomes available again. authentik 2023.8.4 and 2023.10.2 fix this issue. As a workaround, ensure the default admin user (Username `akadmin`) exists and has a password set. It is recommended to use a very strong password for this user, and store it in a secure location like a password manager. It is also possible to deactivate the user to prevent any logins as akadmin.\"},{\"lang\":\"es\",\"value\":\"authentik es un proveedor de identidades de c\u00f3digo abierto. Antes de las versiones 2023.8.4 y 2023.10.2, cuando se eliminaba el usuario administrador predeterminado, era posible que un atacante estableciera la contrase\u00f1a del usuario administrador predeterminado sin ninguna autenticaci\u00f3n. authentik utiliza un modelo para crear el usuario administrador predeterminado, que tambi\u00e9n puede establecer opcionalmente la contrase\u00f1a de los usuarios administradores predeterminados desde una variable de entorno. Cuando se elimina el usuario, el flujo de \\\"configuraci\u00f3n inicial\\\" utilizado para configurar authentik despu\u00e9s de la primera instalaci\u00f3n vuelve a estar disponible. authentik 2023.8.4 y 2023.10.2 solucionan este problema. Como workaround, aseg\u00farese de que el usuario administrador predeterminado (nombre de usuario `akadmin`) exista y tenga una contrase\u00f1a establecida. Se recomienda utilizar una contrase\u00f1a muy segura para este usuario y guardarla en un lugar seguro como un administrador de contrase\u00f1as. Tambi\u00e9n es posible desactivar el usuario para evitar inicios de sesi\u00f3n como akaadmin.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H\",\"baseScore\":9.6,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":6.0},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-287\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-306\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:goauthentik:authentik:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"2023.8.4\",\"matchCriteriaId\":\"5889E9B4-DDA1-474A-A1AB-1483E2F5FDE8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:goauthentik:authentik:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2023.10.0\",\"versionEndExcluding\":\"2023.10.2\",\"matchCriteriaId\":\"AA3E7BC0-8AEE-4861-949A-86818D17DEFD\"}]}]}],\"references\":[{\"url\":\"https://github.com/goauthentik/authentik/commit/261879022d25016d58867cf1f24e90b81ad618d0\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/goauthentik/authentik/commit/ea75741ec22ecef34bc7073f1163e17a8a2bf9fc\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/goauthentik/authentik/releases/tag/version%2F2023.10.2\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://github.com/goauthentik/authentik/releases/tag/version%2F2023.8.4\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://github.com/goauthentik/authentik/security/advisories/GHSA-rjvp-29xq-f62w\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://github.com/goauthentik/authentik/commit/261879022d25016d58867cf1f24e90b81ad618d0\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/goauthentik/authentik/commit/ea75741ec22ecef34bc7073f1163e17a8a2bf9fc\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/goauthentik/authentik/releases/tag/version%2F2023.10.2\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://github.com/goauthentik/authentik/releases/tag/version%2F2023.8.4\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://github.com/goauthentik/authentik/security/advisories/GHSA-rjvp-29xq-f62w\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]}]}}",
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://github.com/goauthentik/authentik/security/advisories/GHSA-rjvp-29xq-f62w\", \"name\": \"https://github.com/goauthentik/authentik/security/advisories/GHSA-rjvp-29xq-f62w\", \"tags\": [\"x_refsource_CONFIRM\", \"x_transferred\"]}, {\"url\": \"https://github.com/goauthentik/authentik/commit/261879022d25016d58867cf1f24e90b81ad618d0\", \"name\": \"https://github.com/goauthentik/authentik/commit/261879022d25016d58867cf1f24e90b81ad618d0\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"https://github.com/goauthentik/authentik/commit/ea75741ec22ecef34bc7073f1163e17a8a2bf9fc\", \"name\": \"https://github.com/goauthentik/authentik/commit/ea75741ec22ecef34bc7073f1163e17a8a2bf9fc\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"https://github.com/goauthentik/authentik/releases/tag/version%2F2023.10.2\", \"name\": \"https://github.com/goauthentik/authentik/releases/tag/version%2F2023.10.2\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"https://github.com/goauthentik/authentik/releases/tag/version%2F2023.8.4\", \"name\": \"https://github.com/goauthentik/authentik/releases/tag/version%2F2023.8.4\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T20:37:40.163Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2023-46249\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-05T15:53:19.845105Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:goauthentik:authentik:*:*:*:*:*:*:*:*\"], \"vendor\": \"goauthentik\", \"product\": \"authentik\", \"versions\": [{\"status\": \"affected\", \"version\": \"2023.10.0\", \"lessThan\": \"2023.10.2\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-05T15:55:46.829Z\"}}], \"cna\": {\"title\": \"authentik potential installation takeover when default admin user is deleted\", \"source\": {\"advisory\": \"GHSA-rjvp-29xq-f62w\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 9.7, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"goauthentik\", \"product\": \"authentik\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 2023.8.4\"}, {\"status\": \"affected\", \"version\": \"\u003e= 2023.10.0, \u003c 2023.10.2\"}]}], \"references\": [{\"url\": \"https://github.com/goauthentik/authentik/security/advisories/GHSA-rjvp-29xq-f62w\", \"name\": \"https://github.com/goauthentik/authentik/security/advisories/GHSA-rjvp-29xq-f62w\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/goauthentik/authentik/commit/261879022d25016d58867cf1f24e90b81ad618d0\", \"name\": \"https://github.com/goauthentik/authentik/commit/261879022d25016d58867cf1f24e90b81ad618d0\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/goauthentik/authentik/commit/ea75741ec22ecef34bc7073f1163e17a8a2bf9fc\", \"name\": \"https://github.com/goauthentik/authentik/commit/ea75741ec22ecef34bc7073f1163e17a8a2bf9fc\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/goauthentik/authentik/releases/tag/version%2F2023.10.2\", \"name\": \"https://github.com/goauthentik/authentik/releases/tag/version%2F2023.10.2\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/goauthentik/authentik/releases/tag/version%2F2023.8.4\", \"name\": \"https://github.com/goauthentik/authentik/releases/tag/version%2F2023.8.4\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"authentik is an open-source Identity Provider. Prior to versions 2023.8.4 and 2023.10.2, when the default admin user has been deleted, it is potentially possible for an attacker to set the password of the default admin user without any authentication. authentik uses a blueprint to create the default admin user, which can also optionally set the default admin users\u0027 password from an environment variable. When the user is deleted, the `initial-setup` flow used to configure authentik after the first installation becomes available again. authentik 2023.8.4 and 2023.10.2 fix this issue. As a workaround, ensure the default admin user (Username `akadmin`) exists and has a password set. It is recommended to use a very strong password for this user, and store it in a secure location like a password manager. It is also possible to deactivate the user to prevent any logins as akadmin.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-287\", \"description\": \"CWE-287: Improper Authentication\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2023-10-31T15:20:35.166Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2023-46249\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-09-05T15:55:53.846Z\", \"dateReserved\": \"2023-10-19T20:34:00.948Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2023-10-31T15:20:35.166Z\", \"assignerShortName\": \"GitHub_M\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…