Description
OpenMetadata存在默认账号密码，攻击者可以登录后台获取后台权限。
OpenMetadata存在默认账号密码
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://docs.open-metadata.org/v1.11.x/deployment/security/basic-auth
https://wh0am1i.com/2024/04/17/OpenMetadata-auth-bypass-and-spel-injection/index.html
https://github.com/open-metadata/OpenMetadata/discussions/14073
https://blog.csdn.net/yijian0645/article/details/136617195
https://atlan.com/openmetadata-setup/
https://open-metadata.org/cve-list
https://www.microsoft.com/en-us/security/blog/2024/04/17/attackers-exploiting-new-critical-openmetadata-vulnerabilities-on-kubernetes-clusters/
https://nvd.nist.gov/vuln/detail/cve-2024-28255