Skyline DataMiner BrokerGateway embedded API key authentication bypass
Anyone can get into the DataMiner message channel without a password.
Summary
An embedded API key in BrokerGateway lets unauthenticated attackers retrieve a message-bus credential and get access. Users of DataMiner versions before the listed fixes are affected.
What to do
Update to DataMiner 10.6.9 CU1, 10.6.0 CU7, 10.5.0 CU19 or 10.4.0 CU22.
Update to at least the version for your product:
- Skyline DataMiner 10.6.9 10.6.9 CU1 or later
- Skyline DataMiner 10.6.0 10.6.0 CU7 or later
- Skyline DataMiner 10.5.0 10.5.0 CU19 or later
- Skyline DataMiner 10.4.0 10.4.0 CU22 or later
Products and platforms
CVE IDs
Sources
- Advisory: community.dataminer.services (opens in a new tab)
- Write-up: vulncheck.com (opens in a new tab)
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen