CVE-2023-37268
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
Warpgate is an SSH, HTTPS and MySQL bastion host for Linux that doesn't need special client apps. An attacker may authenticate as another user when logging in as a user with SSO enabled, and any user account without a second factor enabled could be compromised.
Risk Assessment
The organization may be at risk of user account takeover for accounts without a second factor enabled, potentially leading to unauthorized access to systems.
Recommendation
It is recommended to upgrade to version 0.7.3 or later. Users unable to upgrade should require their users to use a second factor in authentication.
Original NVD description (English source)
Warpgate is an SSH, HTTPS and MySQL bastion host for Linux that doesn't need special client apps. When logging in as a user with SSO enabled an attacker may authenticate as an other user. Any user account which does not have a second factor enabled could be compromised. This issue has been addressed in commit `8173f6512a` and in releases starting with version 0.7.3. Users are advised to upgrade. Users unable to upgrade should require their users to use a second factor in authentication.