{"id":"CVE-2023-51982","aliases":["EUVD-2024-0030","GHSA-7mgx-gvjw-m3w3","PYSEC-2024-27"],"status":"published","title":"CrateDB authentication bypass vulnerability","description":"CrateDB 5.5.1 is contains an authentication bypass vulnerability in the Admin UI component. After configuring password authentication and_ Local_ In the case of an address, identity authentication can be bypassed by setting the X-Real IP request header to a specific value and accessing the Admin UI directly using the default user identity.(https://github.com/crate/crate/issues/15231)","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00731,"percentile":0.5457,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-287"],"published":"2024-01-30T00:00:00Z","modified":"2026-10-28T02:30:57Z","fixes":[{"ecosystem":"Maven","package":"io.crate:crate","fixed_in":["5.2.11","5.3.8","5.4.7","5.5.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"io.crate:crate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.11"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"io.crate:crate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.0"},{"fixed":"5.3.8"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"io.crate:crate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.4.0"},{"fixed":"5.4.7"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"io.crate:crate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.5.0"},{"fixed":"5.5.2"}]}]},{"source":"osv","ecosystem":"Maven","package":"io.crate:crate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.11"}]}]},{"source":"osv","ecosystem":"Maven","package":"io.crate:crate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.0"},{"fixed":"5.3.8"}]}]},{"source":"osv","ecosystem":"Maven","package":"io.crate:crate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.4.0"},{"fixed":"5.4.7"}]}]},{"source":"osv","ecosystem":"Maven","package":"io.crate:crate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.5.0"},{"fixed":"5.5.2"}]}]}],"products":[{"vendor":"cratedb","product":"cratedb"}],"references":[{"url":"https://github.com/crate/crate/issues/15231","tags":["x_transferred","Exploit","Issue Tracking","report","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-51982","tags":["advisory"]},{"url":"https://github.com/crate/crate/pull/15234","tags":["web"]},{"url":"https://github.com/crate/crate/commit/0c166ef083bec4d64dd55c1d8cb9b3dec350d241","tags":["web"]},{"url":"https://github.com/crate/crate/commit/5be7b3864137c23305ece10df3f7c311ee50ae4d","tags":["web"]},{"url":"https://github.com/crate/crate/commit/b8b4cec49a1c7eb2b5af568400bd571d194dc03e","tags":["web"]},{"url":"https://github.com/crate/crate/commit/da59311ca920743ebc58ee64c29cfe5723487f56","tags":["web"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/crate/PYSEC-2024-27.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-7mgx-gvjw-m3w3"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/51xxx/CVE-2023-51982.json","tags":["advisory"]},{"url":"https://github.com/crate/crate","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2023-51982","description":"CrateDB 5.5.1 is contains an authentication bypass vulnerability in the Admin UI component. After configuring password authentication and_ Local_ In the case of an address, identity authentication can be bypassed by setting the X-Real IP request header to a specific value and accessing the Admin UI directly using the default user identity.(https://github.com/crate/crate/issues/15231)","status":"published","published":"2024-01-30T00:00:00Z","modified":"2025-05-29T15:07:59.172Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:35:17.48054Z"}],"euvd":[{"id":"EUVD-2024-0030","description":"CrateDB 5.5.1 is contains an authentication bypass vulnerability in the Admin UI component. After configuring password authentication and_ Local_ In the case of an address, identity authentication can be bypassed by setting the X-Real IP request header to a specific value and accessing the Admin UI directly using the default user identity.(https://github.com/crate/crate/issues/15231)","status":"published","published":"2024-01-30T00:00:00Z","modified":"2025-05-29T15:07:59Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T20:32:35.823426Z"}],"ghsa":[{"id":"GHSA-7mgx-gvjw-m3w3","title":"CrateDB authentication bypass vulnerability","description":"CrateDB 5.5.1 is contains an authentication bypass vulnerability in the Admin UI component. After configuring password authentication and_ Local_ In the case of an address, identity authentication can be bypassed by setting the X-Real IP request header to a specific value and accessing the Admin UI directly using the default user identity.","status":"published","published":"2024-01-30T03:30:30Z","modified":"2024-11-20T18:42:40Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:38:21.777721Z"}],"nvd":[{"id":"CVE-2023-51982","description":"CrateDB 5.5.1 is contains an authentication bypass vulnerability in the Admin UI component. After configuring password authentication and_ Local_ In the case of an address, identity authentication can be bypassed by setting the X-Real IP request header to a specific value and accessing the Admin UI directly using the default user identity.(https://github.com/crate/crate/issues/15231)","status":"published","published":"2024-01-30T01:15:59.013Z","modified":"2026-06-17T06:41:55.38Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:09:04.527564Z"}],"osv":[{"id":"CVE-2023-51982","description":"CrateDB 5.5.1 is contains an authentication bypass vulnerability in the Admin UI component. After configuring password authentication and_ Local_ In the case of an address, identity authentication can be bypassed by setting the X-Real IP request header to a specific value and accessing the Admin UI directly using the default user identity.(https://github.com/crate/crate/issues/15231)","status":"published","published":"2024-01-30T00:00:00Z","modified":"2026-10-28T02:30:57.841078736Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:35.245372Z"},{"id":"GHSA-7mgx-gvjw-m3w3","title":"CrateDB authentication bypass vulnerability","description":"CrateDB 5.5.1 is contains an authentication bypass vulnerability in the Admin UI component. After configuring password authentication and_ Local_ In the case of an address, identity authentication can be bypassed by setting the X-Real IP request header to a specific value and accessing the Admin UI directly using the default user identity.","status":"published","published":"2024-01-30T03:30:30Z","modified":"2024-11-21T04:26:59.277852Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"},{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T15:46:41.349637Z"},{"id":"PYSEC-2024-27","description":"CrateDB 5.5.1 is contains an authentication bypass vulnerability in the Admin UI component. After configuring password authentication and_ Local_ In the case of an address, identity authentication can be bypassed by setting the X-Real IP request header to a specific value and accessing the Admin UI directly using the default user identity.(https://github.com/crate/crate/issues/15231)","status":"withdrawn","published":"2024-01-30T01:15:00Z","modified":"2025-10-09T08:27:35.57088Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:54.242332Z"}]}}