{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-46249", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2023-10-19T20:34:00.948Z", "datePublished": "2023-10-31T15:20:35.166Z", "dateUpdated": "2024-09-05T15:55:53.846Z"}, "containers": {"cna": {"title": "authentik potential installation takeover when default admin user is deleted", "problemTypes": [{"descriptions": [{"cweId": "CWE-287", "lang": "en", "description": "CWE-287: Improper Authentication", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.7, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/goauthentik/authentik/security/advisories/GHSA-rjvp-29xq-f62w", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/goauthentik/authentik/security/advisories/GHSA-rjvp-29xq-f62w"}, {"name": "https://github.com/goauthentik/authentik/commit/261879022d25016d58867cf1f24e90b81ad618d0", "tags": ["x_refsource_MISC"], "url": "https://github.com/goauthentik/authentik/commit/261879022d25016d58867cf1f24e90b81ad618d0"}, {"name": "https://github.com/goauthentik/authentik/commit/ea75741ec22ecef34bc7073f1163e17a8a2bf9fc", "tags": ["x_refsource_MISC"], "url": "https://github.com/goauthentik/authentik/commit/ea75741ec22ecef34bc7073f1163e17a8a2bf9fc"}, {"name": "https://github.com/goauthentik/authentik/releases/tag/version%2F2023.10.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/goauthentik/authentik/releases/tag/version%2F2023.10.2"}, {"name": "https://github.com/goauthentik/authentik/releases/tag/version%2F2023.8.4", "tags": ["x_refsource_MISC"], "url": "https://github.com/goauthentik/authentik/releases/tag/version%2F2023.8.4"}], "affected": [{"vendor": "goauthentik", "product": "authentik", "versions": [{"version": "< 2023.8.4", "status": "affected"}, {"version": ">= 2023.10.0, < 2023.10.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2023-10-31T15:20:35.166Z"}, "descriptions": [{"lang": "en", "value": "authentik is an open-source Identity Provider. Prior to versions 2023.8.4 and 2023.10.2, when the default admin user has been deleted, it is potentially possible for an attacker to set the password of the default admin user without any authentication. authentik uses a blueprint to create the default admin user, which can also optionally set the default admin users' password from an environment variable. When the user is deleted, the `initial-setup` flow used to configure authentik after the first installation becomes available again. authentik 2023.8.4 and 2023.10.2 fix this issue. As a workaround, ensure the default admin user (Username `akadmin`) exists and has a password set. It is recommended to use a very strong password for this user, and store it in a secure location like a password manager. It is also possible to deactivate the user to prevent any logins as akadmin."}], "source": {"advisory": "GHSA-rjvp-29xq-f62w", "discovery": "UNKNOWN"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T20:37:40.163Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/goauthentik/authentik/security/advisories/GHSA-rjvp-29xq-f62w", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/goauthentik/authentik/security/advisories/GHSA-rjvp-29xq-f62w"}, {"name": "https://github.com/goauthentik/authentik/commit/261879022d25016d58867cf1f24e90b81ad618d0", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/goauthentik/authentik/commit/261879022d25016d58867cf1f24e90b81ad618d0"}, {"name": "https://github.com/goauthentik/authentik/commit/ea75741ec22ecef34bc7073f1163e17a8a2bf9fc", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/goauthentik/authentik/commit/ea75741ec22ecef34bc7073f1163e17a8a2bf9fc"}, {"name": "https://github.com/goauthentik/authentik/releases/tag/version%2F2023.10.2", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/goauthentik/authentik/releases/tag/version%2F2023.10.2"}, {"name": "https://github.com/goauthentik/authentik/releases/tag/version%2F2023.8.4", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/goauthentik/authentik/releases/tag/version%2F2023.8.4"}]}, {"affected": [{"vendor": "goauthentik", "product": "authentik", "cpes": ["cpe:2.3:a:goauthentik:authentik:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "2023.10.0", "status": "affected", "lessThan": "2023.10.2", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-09-05T15:53:19.845105Z", "id": "CVE-2023-46249", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-05T15:55:53.846Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/goauthentik/authentik/security/advisories/GHSA-rjvp-29xq-f62w", "name": "https://github.com/goauthentik/authentik/security/advisories/GHSA-rjvp-29xq-f62w", "tags": ["x_refsource_CONFIRM", "x_transferred"]}, {"url": "https://github.com/goauthentik/authentik/commit/261879022d25016d58867cf1f24e90b81ad618d0", "name": "https://github.com/goauthentik/authentik/commit/261879022d25016d58867cf1f24e90b81ad618d0", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "https://github.com/goauthentik/authentik/commit/ea75741ec22ecef34bc7073f1163e17a8a2bf9fc", "name": "https://github.com/goauthentik/authentik/commit/ea75741ec22ecef34bc7073f1163e17a8a2bf9fc", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "https://github.com/goauthentik/authentik/releases/tag/version%2F2023.10.2", "name": "https://github.com/goauthentik/authentik/releases/tag/version%2F2023.10.2", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "https://github.com/goauthentik/authentik/releases/tag/version%2F2023.8.4", "name": "https://github.com/goauthentik/authentik/releases/tag/version%2F2023.8.4", "tags": ["x_refsource_MISC", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T20:37:40.163Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-46249", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-05T15:53:19.845105Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:goauthentik:authentik:*:*:*:*:*:*:*:*"], "vendor": "goauthentik", "product": "authentik", "versions": [{"status": "affected", "version": "2023.10.0", "lessThan": "2023.10.2", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-05T15:55:46.829Z"}}], "cna": {"title": "authentik potential installation takeover when default admin user is deleted", "source": {"advisory": "GHSA-rjvp-29xq-f62w", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.7, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "goauthentik", "product": "authentik", "versions": [{"status": "affected", "version": "< 2023.8.4"}, {"status": "affected", "version": ">= 2023.10.0, < 2023.10.2"}]}], "references": [{"url": "https://github.com/goauthentik/authentik/security/advisories/GHSA-rjvp-29xq-f62w", "name": "https://github.com/goauthentik/authentik/security/advisories/GHSA-rjvp-29xq-f62w", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/goauthentik/authentik/commit/261879022d25016d58867cf1f24e90b81ad618d0", "name": "https://github.com/goauthentik/authentik/commit/261879022d25016d58867cf1f24e90b81ad618d0", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/goauthentik/authentik/commit/ea75741ec22ecef34bc7073f1163e17a8a2bf9fc", "name": "https://github.com/goauthentik/authentik/commit/ea75741ec22ecef34bc7073f1163e17a8a2bf9fc", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/goauthentik/authentik/releases/tag/version%2F2023.10.2", "name": "https://github.com/goauthentik/authentik/releases/tag/version%2F2023.10.2", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/goauthentik/authentik/releases/tag/version%2F2023.8.4", "name": "https://github.com/goauthentik/authentik/releases/tag/version%2F2023.8.4", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "authentik is an open-source Identity Provider. Prior to versions 2023.8.4 and 2023.10.2, when the default admin user has been deleted, it is potentially possible for an attacker to set the password of the default admin user without any authentication. authentik uses a blueprint to create the default admin user, which can also optionally set the default admin users' password from an environment variable. When the user is deleted, the `initial-setup` flow used to configure authentik after the first installation becomes available again. authentik 2023.8.4 and 2023.10.2 fix this issue. As a workaround, ensure the default admin user (Username `akadmin`) exists and has a password set. It is recommended to use a very strong password for this user, and store it in a secure location like a password manager. It is also possible to deactivate the user to prevent any logins as akadmin."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-287", "description": "CWE-287: Improper Authentication"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2023-10-31T15:20:35.166Z"}}}, "cveMetadata": {"cveId": "CVE-2023-46249", "state": "PUBLISHED", "dateUpdated": "2024-09-05T15:55:53.846Z", "dateReserved": "2023-10-19T20:34:00.948Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2023-10-31T15:20:35.166Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:goauthentik:authentik:*:*:*:*:*:*:*:*", "matchCriteriaId": "5889E9B4-DDA1-474A-A1AB-1483E2F5FDE8", "versionEndExcluding": "2023.8.4", "vulnerable": true}, {"criteria": "cpe:2.3:a:goauthentik:authentik:*:*:*:*:*:*:*:*", "matchCriteriaId": "AA3E7BC0-8AEE-4861-949A-86818D17DEFD", "versionEndExcluding": "2023.10.2", "versionStartIncluding": "2023.10.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "authentik is an open-source Identity Provider. Prior to versions 2023.8.4 and 2023.10.2, when the default admin user has been deleted, it is potentially possible for an attacker to set the password of the default admin user without any authentication. authentik uses a blueprint to create the default admin user, which can also optionally set the default admin users' password from an environment variable. When the user is deleted, the `initial-setup` flow used to configure authentik after the first installation becomes available again. authentik 2023.8.4 and 2023.10.2 fix this issue. As a workaround, ensure the default admin user (Username `akadmin`) exists and has a password set. It is recommended to use a very strong password for this user, and store it in a secure location like a password manager. It is also possible to deactivate the user to prevent any logins as akadmin."}, {"lang": "es", "value": "authentik es un proveedor de identidades de c\u00f3digo abierto. Antes de las versiones 2023.8.4 y 2023.10.2, cuando se eliminaba el usuario administrador predeterminado, era posible que un atacante estableciera la contrase\u00f1a del usuario administrador predeterminado sin ninguna autenticaci\u00f3n. authentik utiliza un modelo para crear el usuario administrador predeterminado, que tambi\u00e9n puede establecer opcionalmente la contrase\u00f1a de los usuarios administradores predeterminados desde una variable de entorno. Cuando se elimina el usuario, el flujo de \"configuraci\u00f3n inicial\" utilizado para configurar authentik despu\u00e9s de la primera instalaci\u00f3n vuelve a estar disponible. authentik 2023.8.4 y 2023.10.2 solucionan este problema. Como workaround, aseg\u00farese de que el usuario administrador predeterminado (nombre de usuario `akadmin`) exista y tenga una contrase\u00f1a establecida. Se recomienda utilizar una contrase\u00f1a muy segura para este usuario y guardarla en un lugar seguro como un administrador de contrase\u00f1as. Tambi\u00e9n es posible desactivar el usuario para evitar inicios de sesi\u00f3n como akaadmin."}], "id": "CVE-2023-46249", "lastModified": "2023-11-08T17:50:18.727", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.6, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 6.0, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2023-10-31T16:15:09.853", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/goauthentik/authentik/commit/261879022d25016d58867cf1f24e90b81ad618d0"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/goauthentik/authentik/commit/ea75741ec22ecef34bc7073f1163e17a8a2bf9fc"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/goauthentik/authentik/releases/tag/version%2F2023.10.2"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/goauthentik/authentik/releases/tag/version%2F2023.8.4"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/goauthentik/authentik/security/advisories/GHSA-rjvp-29xq-f62w"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-306"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-287"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}