CVE-2023-22495
Published: 14 January 2023
Summary
CVE-2023-22495 is a critical-severity Authentication Bypass Using an Alternate Path or Channel (CWE-288) vulnerability in Maif Izanami. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 36.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-26636
Vulnerability details
Izanami is a shared configuration service well-suited for micro-service architecture implementation. Attackers can bypass the authentication in this application when deployed using the official Docker image. Because a hard coded secret is used to sign the authentication token (JWT), an…
more
attacker could compromise another instance of Izanami. This issue has been patched in version 1.11.0.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Users can identify logons via alternate paths or channels by reviewing the previous logon time.
Centralized IdPs close alternate authentication paths that enable bypass.
Authorizing remote access reduces the ability to bypass authentication via unauthorized alternate remote channels.
Security training explicitly warns against hard-coded credentials, lowering their use in systems.
Policy and procedures prohibit hard-coded credentials in favor of managed authentication.
Adaptive requirements can apply across access paths, reducing the ability to bypass authentication via alternate channels or paths.
Changing default authenticators prior to first use and protecting content prevents use of hard-coded credentials.
Enforces authentication for non-organizational users, making it harder to bypass via alternate paths or channels.