CVSS 3.1
6.5 mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:NCVE-2022-39219
Medium (6.5) in xbifrost bifrost. EPSS 1.2% chance of exploitation in the next 30 days. Fixed in github.com/brokercap/Bifrost 1.8.7-release.
Bifrost is a middleware package which can synchronize MySQL/MariaDB binlog data to other types of databases. Versions 1.8.6-release and prior are vulnerable to authentication bypass when using HTTP basic authentication. This may allow group members who only have read permissions to write requests when they are normally forbidden from doing so. Version 1.8.7-release contains a patch. There are currently no known workarounds.
Severity
- EPSS
- 1.2% chance of exploitation in the next 30 days; higher than 67% of CVEs (scores of 2026-10-31)
- CWE
- CWE-287
- Published
- Modified
- Record from
- the NVD, synced
Affected
- xbifrost:bifrost
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-p6fh-xc6r-g5hw | Go | github.com/brokercap/Bifrost | <1.8.7-release | 1.8.7-release |
| GO-2022-1023 | Go | github.com/brokercap/Bifrost | <1.8.7-release | 1.8.7-release |