CVE-2023-47629: Privilege escalation through email sign-up in datahub
DataHub is an open-source metadata platform. In affected versions sign-up through an invite link does not properly restrict users from signing up as privileged accounts. If a user is given an email sign-up link they can potentially create an admin account given certain preconditions. If the default datahub user has been removed, then the user can sign up for an account that leverages the default policies giving admin privileges to the datahub user. All DataHub instances prior to the patch that have removed the datahub user, but not the default policies applying to that user are affected. Users are advised to update to version 0.12.1 which addresses the issue. There are no known workarounds for this vulnerability.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-47629?
CVE-2023-47629 is a vulnerability that allows privilege escalation through email sign-up in DataHub.
What is the severity of CVE-2023-47629?
CVE-2023-47629 has a severity level of high.
How does CVE-2023-47629 affect DataHub?
CVE-2023-47629 affects DataHub versions up to and excluding 0.12.1.
How can CVE-2023-47629 be exploited?
CVE-2023-47629 can be exploited when users sign up through an invite link, allowing them to create an admin account.
Is there a fix for CVE-2023-47629?
A fix for CVE-2023-47629 is not currently available. It is advised to keep software up to date and follow the recommendations from the DataHub project.