Amit Laish

ZITADEL, an open source identity management platform, has a flaw in its login V2 interface that could allow for account takeover via Default URI Redirect. An unauthenticated remote attacker can exploit a Stored XSS vulnerability to reset passwords and take over accounts. This is due to missing restrictions and improper handling of the default redirect URI, allowing malicious JavaScript code to be executed in the Zitadel login UI. The issue is mitigated for accounts with Multi-Factor Authentication (MFA) or Passwordless authentication enabled. The vulnerable component is the login V2 interface.

Name of the Vulnerable Software and Affected Versions: Cisco Adaptive Security Appliance (ASA) Software (affected versions not specified) Cisco Firepower Threat Defense (FTD) Software (affected versions not specified) Description: A vulnerability in the VPN web client services feature could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a browser that is accessing an affected device. This issue is due to improper validation of user-supplied input to application endpoints. An attacker could exploit this by persuading a user to follow a link designed to submit malicious input to the affected application, potentially allowing the attacker to execute arbitrary HTML or script code in the browser in the context of the web services page. Recommendations: For Cisco Adaptive Security Appliance (ASA) Software, update to a version that includes the fix for this issue. For Cisco Firepower Threat Defense (FTD) Software, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the VPN web client services feature until a patch is available. Avoid using links from untrusted sources to minimize the risk of exploitation.

The issue is related to the use of a default cryptographic key in the helm chart for deploying Datahub in a Kubernetes cluster. If there was a successful initial deployment during a limited window of time, personal access tokens were possibly created with a default secret key. Since the secret key is a static, publicly available value, someone could inspect the algorithm used to generate personal access tokens and generate their own for an instance. Deploying with Metadata Service Authentication enabled would have been difficult during the window of releases. Most deployments probably did not attempt to circumvent the helm settings to enable Metadata Service Authentication during this time, so impact is most likely limited. Any deployments with Metadata Service Authentication enabled should ensure that their secret values are properly randomized.

A stored cross-site scripting (XSS) vulnerability exists in Apache Superset. An authenticated attacker with create/update permissions on charts or dashboards could store a script or add a specific HTML snippet that would act as a stored XSS. This could allow a remote attacker to conduct cross-site scripting attacks.

An authenticated attacker with update datasets permission could change a dataset link to an untrusted site by spoofing the HTTP Host header. Users could be redirected to this site when clicking on that specific dataset.

The issue allows an authenticated malicious user to initiate multiple concurrent requests, each requesting multiple dashboard exports. This could lead to a possible denial of service.

A vulnerability in the RDF/XML parser of Apache Jena allows an attacker to cause an external DTD to be retrieved. This issue affects versions prior to 4.4.0, excluding Apache Jena 4.2.x and 4.3.x, which do not allow external entities.

The issue allows a malicious user to exploit an open redirect vulnerability through social engineering, potentially leading to the takeover of victims' accounts and redirection of UAA users to malicious sites.

The issue allows remote attackers to view restricted resources via a Pre-Authorization Arbitrary File Read vulnerability in the "/s/" endpoint. This is related to authorization errors. Exploitation of the issue may allow a remote attacker to read arbitrary files.

Name of the Vulnerable Software and Affected Versions: keycloak versions prior to 13.0.0 Description: A flaw in keycloak allows for a Self Stored XSS attack vector, which can escalate to a complete account takeover. This is due to user-supplied data fields not being properly encoded and the use of Javascript code to process the data. The highest threat from this issue is to data confidentiality and integrity, as well as system availability. Recommendations: For versions prior to 13.0.0, update to version 13.0.0 or later to resolve the issue. As a temporary workaround, consider disabling the use of user-supplied data fields in Javascript code until a patch is available. Restrict access to sensitive data and functions to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Crowd versions prior to 4.0.4 Crowd versions 4.1.0 through 4.1.1 Description: The issue allows unauthenticated remote attackers to read arbitrary files within WEB-INF and META-INF directories via an incorrect path access check in the ResourceDownloadRewriteRule class. Recommendations: For versions prior to 4.0.4, update to version 4.0.4 or later. For versions 4.1.0 through 4.1.1, update to version 4.1.2 or later.

Name of the Vulnerable Software and Affected Versions: Jira Server and Jira Data Center versions prior to 8.5.11 Jira Server and Jira Data Center versions 8.6.0 through 8.13.3 Jira Server and Jira Data Center versions 8.14.0 through 8.14.x Description: The issue allowed unauthenticated remote attackers to read arbitrary files within WEB-INF and META-INF directories via an incorrect path access check in the CachingResourceDownloadRewriteRule class. Recommendations: For versions prior to 8.5.11, update to version 8.5.11 or later. For versions 8.6.0 through 8.13.3, update to version 8.13.3 or later. For versions 8.14.0 through 8.14.x, update to version 8.15.0 or later.

Name of the Vulnerable Software and Affected Versions: Confluence Server versions prior to 6.13.18 Confluence Server versions 6.14.0 through 7.4.5 Confluence Server versions 7.5.0 through 7.8.2 Confluence Data Center versions prior to 6.13.18 Confluence Data Center versions 6.14.0 through 7.4.5 Confluence Data Center versions 7.5.0 through 7.8.2 Description: The issue allowed unauthenticated remote attackers to read arbitrary files within WEB-INF and META-INF directories via an incorrect path access check. This was due to a problem in the ConfluenceResourceDownloadRewriteRule class. Recommendations: For Confluence Server versions prior to 6.13.18, update to version 6.13.18 or later. For Confluence Server versions 6.14.0 through 7.4.5, update to version 7.4.6 or later. For Confluence Server versions 7.5.0 through 7.8.2, update to version 7.8.3 or later. For Confluence Data Center versions prior to 6.13.18, update to version 6.13.18 or later. For Confluence Data Center versions 6.14.0 through 7.4.5, update to version 7.4.6 or later. For Confluence Data Center versions 7.5.0 through 7.8.2, update to version 7.8.3 or later.

The issue concerns an endpoint vulnerable to SCIM injection attack. A remote authenticated malicious user with `scim.invite` scope can craft a request with malicious content, potentially leaking information about users of the UAA.

A remote malicious user can escalate their own privileges to any scope by submitting an array of requested scopes, allowing them to take control of UAA and the resources it controls.

The issue allows a remote malicious user with 'client.write' and 'groups.update' permissions to craft a SCIM query, which leaks information that enables an escalation of privileges. This ultimately allows the malicious user to gain control of UAA scopes they should not have.