<!-- This ticket is confidential. --> <!-- ############################# Do not remove the lines above ############################# --> # CVE Reservation Request The Eclipse Foundation is a [Common Vulnerabilities and Exposures](https://cve.mitre.org/) (CVE) Numbering Authority. Creating this ticket initiates **reservation** of a CVE ID for the documented vulnerability. The reserved CVE ID will be posted in a comment below, and kept **confidential** until explicit publication request. > [!note] > To request CVE *publication*, please open a [CVE publication](https://gitlab.eclipse.org/security/cve-assignment/-/issues/new?issuable_template=CVE%20Publication%20Request&issue[confidential]=true) ticket. Please fill in the fields below to draft the CVE record. --- ## CVE record information **Project name:** Eclipse BaSyx AAS Web UI **Project id:** dt.basyx **Versions affected:** [v2-241220, v2-260924) when Basic Authentication, Bearer Token, or OAuth2 authentication is configured. **Common Weakness Enumeration (CWE):** - [CWE-201: Insertion of Sensitive Information Into Sent Data](https://cwe.mitre.org/data/definitions/201.html) **Common Vulnerability Scoring System:** CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N (7.4) **Summary:** In Eclipse BaSyx AAS Web UI versions v2-241220 through releases before v2-260924, the shared request handler attached the selected infrastructure's `Authorization` header to outgoing requests without checking the destination origin. In deployments using authentication, an attacker could induce a user to open a crafted Web UI link whose `aas` or `path` query parameter points to an attacker-controlled endpoint. The user's browser would then send the configured Basic Authentication credentials, Bearer token, or an available OAuth2 access token to that endpoint. The attacker could reuse the disclosed credential to access protected AAS services with the victim's privileges. The issue is fixed in v2-260924. **Links:** - Confidential vulnerability report: https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/614 - Fix pull request: [https://github.com/eclipse-basyx/basyx-aas-web-ui/pull/1557](https://github.com/eclipse-basyx/basyx-aas-web-ui/pull/1557) - Fixed release: [https://github.com/eclipse-basyx/basyx-aas-web-ui/releases/tag/v2-260924](https://github.com/eclipse-basyx/basyx-aas-web-ui/releases/tag/v2-260924)