CVE-2023-37268 MEDIUM

CVE-2023-37268: User login confusion with SSO in warpgate

Vendor Warp-Tech
Product warpgate
Weakness CWE-287 · Improper authentication
Published July 14, 2023
Last update October 18, 2024
View on NVD All CVEs

CVSS base score

6.4/10
Attack vector Network
Attack complexity High
Privileges required Low
User interaction Required
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N

What the vulnerability does

01Description

Warpgate is an SSH, HTTPS and MySQL bastion host for Linux that doesn't need special client apps. When logging in as a user with SSO enabled an attacker may authenticate as an other user. Any user account which does not have a second factor enabled could be compromised. This issue has been addressed in commit `8173f6512a` and in releases starting with version 0.7.3. Users are advised to upgrade. Users unable to upgrade should require their users to use a second factor in authentication.

Key dates

02Disclosure timeline

July 14, 2023 CVE published
October 18, 2024 Record updated