Medium severity6.4NVD Advisory· Published Jul 14, 2023· Updated Jun 17, 2026

CVE-2023-37268

Description

Warpgate is an SSH, HTTPS and MySQL bastion host for Linux that doesn't need special client apps. When logging in as a user with SSO enabled an attacker may authenticate as an other user. Any user account which does not have a second factor enabled could be compromised. This issue has been addressed in commit 8173f6512a and in releases starting with version 0.7.3. Users are advised to upgrade. Users unable to upgrade should require their users to use a second factor in authentication.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Warpgate Project/Warpgate
cpe:2.3:a:warpgate_project:warpgate:0.7.2:*:*:*:*:*:*:*
Warp Tech/warpgatellm-fuzzy2 versions
>=0.7.3+ 1 more
- (no CPE)range: >=0.7.3
- (no CPE)range: < 0.7.3

Patches

Vulnerability mechanics

References

github.com/warp-tech/warpgate/commit/8173f6512ab6183fa5edc5c9a5f3760b8979271envdPatch
github.com/warp-tech/warpgate/security/advisories/GHSA-868r-97g5-r9g4nvdVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.416
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000