CVE-2023-25562

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2023-25562

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-25562.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2023-25562

Aliases

GHSA-3974-hxjh-m3jj

Published

2023-02-10T22:03:00.889Z

Modified

2026-07-22T02:24:49.097966Z

Severity

6.9 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N CVSS Calculator

Summary

Failure to Invalidate Session on Logout in DataHub

Details

DataHub is an open-source metadata platform. In versions of DataHub prior to 0.8.45 Session cookies are only cleared on new sign-in events and not on logout events. Any authentication checks using the AuthUtils.hasValidSessionCookie() method could be bypassed by using a cookie from a logged out session, as a result any logged out session cookie may be accepted as valid and therefore lead to an authentication bypass to the system. Users are advised to upgrade. There are no known workarounds for this issue. This vulnerability was discovered and reported by the GitHub Security lab and is tracked as GHSL-2022-083.

Database specific

{
    "cwe_ids": [
        "CWE-613"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/25xxx/CVE-2023-25562.json"
}

References

Affected packages

Git / github.com/acryldata/datahub

Affected ranges

Type

GIT

Repo

https://github.com/acryldata/datahub

Events

Introduced

Fixed

39492eaa25fb5ef6c64a3bea9a4cb9bb44f351d5

Database specific

{
    "cpe": "cpe:2.3:a:datahub:datahub:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.8.45"
        }
    ],
    "source": "CPE_RANGE"
}

Type

GIT

Repo

https://github.com/datahub-project/datahub

Events

Introduced

Fixed

af6a423f9d39c1efe308c9722c338fa82e36a55f

Database specific

{
    "cpe": "cpe:2.3:a:datahub:datahub:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.8.45"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ]
}

Affected versions

0.*

0.8.38.4rc1

RC-v0.*

RC-v0.8.28

v0.*

v0.4.1

v0.4.2

v0.4.3

v0.5.0

v0.5.0-BETA

v0.6.0

v0.6.1

v0.7.0

v0.7.1

v0.8.0

v0.8.0-pre

v0.8.1

v0.8.10

v0.8.11

v0.8.12

v0.8.13

v0.8.14

v0.8.15

v0.8.16

v0.8.16.10

v0.8.16.11

v0.8.16.12

v0.8.16.9

v0.8.17

v0.8.17.0

v0.8.17.1

v0.8.17.2

v0.8.17.3

v0.8.17.4

v0.8.17.5

v0.8.17.6

v0.8.17.7

v0.8.18

v0.8.18.0

v0.8.18.1

v0.8.19

v0.8.19.0

v0.8.19.1

v0.8.2

v0.8.20

v0.8.20.0

v0.8.21

v0.8.21.0

v0.8.22

v0.8.22.0

v0.8.22.1

v0.8.23

v0.8.23.0

v0.8.23.1

v0.8.23.2

v0.8.24

v0.8.24.0

v0.8.24.1

v0.8.24.2

v0.8.24.3

v0.8.25

v0.8.25.0

v0.8.25.1

v0.8.25.2

v0.8.26

v0.8.26.0

v0.8.26.1

v0.8.26.2

v0.8.26.5

v0.8.27

v0.8.27.1

v0.8.27.1rc1

v0.8.27.2

v0.8.27.2rc1

v0.8.27.2rc2

v0.8.27.2rc3

v0.8.28

v0.8.28.0

v0.8.28.0rc1

v0.8.28.1

v0.8.28rc1

v0.8.29

v0.8.3

v0.8.30

v0.8.31

v0.8.31.1

v0.8.31.1rc1

v0.8.31.2

v0.8.31.3

v0.8.31.3rc1

v0.8.31.4

v0.8.31.4rc1

v0.8.31.5

v0.8.31.5rc1

v0.8.31.6

v0.8.31.6rc1

v0.8.31.6rc2

v0.8.32

v0.8.32.1

v0.8.32.2

v0.8.32.2rc1

v0.8.32.3

v0.8.32.3rc1

v0.8.32.4

v0.8.32.4rc1

v0.8.32.4rc2

v0.8.32.5

v0.8.32.5rc1

v0.8.32.6

v0.8.32.6rc1

v0.8.32.6rc2

v0.8.32.6rc3

v0.8.32rc1

v0.8.32rc2

v0.8.32rc3

v0.8.32rc4

v0.8.33

v0.8.33.1

v0.8.33.2

v0.8.33.2rc1

v0.8.33.2rc2

v0.8.33.3

v0.8.33.3rc1

v0.8.33.3rc2

v0.8.33.3rc3

v0.8.33rc1

v0.8.34

v0.8.34.1

v0.8.34.1rc1

v0.8.34.1rc2

v0.8.34.1rc3

v0.8.34.2

v0.8.34.2rc1

v0.8.34.2rc2

v0.8.34.2rc3

v0.8.34.2rc4

v0.8.34.3rc1

v0.8.35

v0.8.35.0rc1

v0.8.35.1

v0.8.35.1rc1

v0.8.35.2

v0.8.35.2rc1

v0.8.35.3

v0.8.35.3rc1

v0.8.35.4

v0.8.35.4rc1

v0.8.35.5

v0.8.35.5rc1

v0.8.35.6

v0.8.35.6rc1

v0.8.35.6rc2

v0.8.35.7

v0.8.35.7rc1

v0.8.35.8rc1

v0.8.35.8rc2

v0.8.35.8rc3

v0.8.36

v0.8.36.0rc0

v0.8.36.1rc1

v0.8.36.1rc10

v0.8.36.1rc2

v0.8.36.1rc3

v0.8.36.1rc4

v0.8.36.1rc5

v0.8.36.1rc6

v0.8.36.1rc7

v0.8.36.1rc8

v0.8.36.1rc9

v0.8.36rc1

v0.8.37

v0.8.37.0rc0

v0.8.37rc0

v0.8.38

v0.8.38.1

v0.8.38.1rc0

v0.8.38.1rc1

v0.8.38.2

v0.8.38.2rc1

v0.8.38.3

v0.8.38.3rc1

v0.8.38.4

v0.8.38.4rc0

v0.8.38.4rc1

v0.8.38.4rc2

v0.8.38.4rc3

v0.8.38.5

v0.8.38.5rc0

v0.8.39

v0.8.39.1rc1

v0.8.39.1rc2

v0.8.39.1rc3

v0.8.39.1rc4

v0.8.39.1rc5

v0.8.39.1rc6

v0.8.39.1rc7

v0.8.39.1rc8

v0.8.39rc0

v0.8.4

v0.8.40

v0.8.40.1

v0.8.40.2

v0.8.40.2rc0

v0.8.40.3

v0.8.40.3rc0

v0.8.40.3rc1

v0.8.40.3rc2

v0.8.40.3rc3

v0.8.40.4rc1

v0.8.40.4rc2

v0.8.40rc1

v0.8.41

v0.8.41.1

v0.8.41.1rc0

v0.8.41.1rc1

v0.8.41.1rc2

v0.8.41.1rc3

v0.8.41.1rc4

v0.8.41.2

v0.8.41.2rc0

v0.8.41.2rc1

v0.8.41.3rc1

v0.8.41.3rc2

v0.8.41.3rc3

v0.8.41rc1

v0.8.41rc2

v0.8.42

v0.8.42rc1

v0.8.42rc2

v0.8.43

v0.8.43.1

v0.8.43.1rc0

v0.8.43.1rc1

v0.8.43.2

v0.8.43.2rc0

v0.8.43.2rc1

v0.8.43.3

v0.8.43.3rc0

v0.8.43.3rc1

v0.8.43.3rc2

v0.8.43.3rc3

v0.8.43.3rc4

v0.8.43.3rc5

v0.8.43.4

v0.8.43.4rc1

v0.8.43.4rc2

v0.8.43.5

v0.8.43.5rc1

v0.8.43.5rc2

v0.8.43.5rc3

v0.8.43.6

v0.8.43.6rc0

v0.8.43.6rc1

v0.8.43rc2

v0.8.43rc3

v0.8.43rc4

v0.8.44

v0.8.44.1

v0.8.44.1rc0

v0.8.44.1rc1

v0.8.44.1rc2

v0.8.44.1rc3

v0.8.44.1rc4

v0.8.44.2

v0.8.44.2rc0

v0.8.44.2rc1

v0.8.44.2rc2

v0.8.44.3

v0.8.44.3rc0

v0.8.44.3rc1

v0.8.44.3rc2

v0.8.44.3rc3

v0.8.44.3rc4

v0.8.44.4

v0.8.44.4rc0

v0.8.44.4rc1

v0.8.44.5

v0.8.44.5rc0

v0.8.44.5rc1

v0.8.44.5rc2

v0.8.44.5rc3

v0.8.44rc0

v0.8.44rc1

v0.8.44rc2

v0.8.44rc3

v0.8.44rc4

v0.8.44rc5

v0.8.5

v0.8.6

v0.8.7

v0.8.8

v0.8.9

Database specific

vanir_signatures_modified

"2026-07-22T02:24:49Z"

vanir_signatures

[
    {
        "signature_type": "Line",
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "31554251648533416152623010086936924547",
                "155760737878228610195097988911985706046",
                "284220006101245241007895365429582833180",
                "221398545169308186189998836629710439288"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/datahub-project/datahub/commit/af6a423f9d39c1efe308c9722c338fa82e36a55f",
        "id": "CVE-2023-25562-16f79a12",
        "target": {
            "file": "metadata-service/servlet/src/main/java/com/datahub/gms/servlet/Config.java"
        }
    }
]

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-25562.json"