Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
VOLERION
Volerion Security Research

NOT DEFERRED DATABASE

VULNERABILITIES

CVE-2022-39267 Details

Description

Bifrost is a heterogeneous middleware that synchronizes MySQL, MariaDB to Redis, MongoDB, ClickHouse, MySQL and other services for production environments. Versions prior to 1.8.8-release are subject to authentication bypass in the admin and monitor user groups by deleting the X-Requested-With: XMLHttpRequest field in the request header. This issue has been patched in 1.8.8-release. There are no known workarounds.

Metrics

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URLSource(s)Tag(s)
https://github.com/brockercap/Bifrost/pull/201 CVEBroken Link
https://github.com/brokercap/Bifrost/security/advisories/GHSA-mxrx-fg8p-5p5j CVEPatchThird Party Advisory
https://github.com/brockercap/Bifrost/pull/201 [email protected]Broken Link
https://github.com/brokercap/Bifrost/security/advisories/GHSA-mxrx-fg8p-5p5j [email protected]PatchThird Party Advisory

Weakness Enumeration

CWE-IDCWE NameSource
CWE-287Improper Authentication[email protected]
CWE-287Improper Authentication[email protected]

Affected Products

ProductVersions
xbifrost bifrost
<= 1.8.6

CPE

  • cpe:2.3:a:xbifrost:bifrost:*:*:*:*:*:*:*:*

Remediation

  • No remediation found in references.

Change History

5 change records found show changes

QUICK INFO

CVE Dictionary Entry:
CVE-2022-39267
NVD Published Date:
Oct 19, 2022
NVD Last Modified:
Jun 17, 2026
Source:
[email protected]
CVE-2022-39267 Details - Not Deferred