CVE-2023-25559

Advisory

DataHub under 0.8.45 uses the X-DataHub-Actor HTTP header to identify the user making requests without authentication. However, this can be exploited by attackers who can manipulate the case of the header (e.g., X-DATAHUB-ACTOR), leading to potential authorization bypass and unauthorized actions. This issue, identified and reported by GitHub Security Lab, is known as GHSL-2022-079.
https://github.com/datahub-project/datahub/security/advisories/GHSA-qgp2-qr66-j8r8

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://github.com/datahub-project/datahub/security/advisories/GHSA-qgp2-qr66-j8r8
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25559