GHSA-2894-qcqf-g23g

Suggest an improvement
Source
https://github.com/advisories/GHSA-2894-qcqf-g23g
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-2894-qcqf-g23g/GHSA-2894-qcqf-g23g.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-2894-qcqf-g23g
Aliases
Published
2023-10-03T06:30:26Z
Modified
2024-02-16T08:07:34.917892Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
asyncua Improper Authentication vulnerability
Details

Versions of the package asyncua before 0.9.96 are vulnerable to Improper Authentication such that it is possible to access Address Space without encryption and authentication.

Note:

This issue is a result of missing checks for services that require an active session.

Database specific 
{
    "github_reviewed_at": "2023-10-04T14:13:24Z",
    "nvd_published_at": "2023-10-03T05:15:49Z",
    "severity": "HIGH",
    "cwe_ids": [
        "CWE-287"
    ],
    "github_reviewed": true
}
References

Affected packages

PyPI / asyncua

Package

Name
asyncua
View open source insights on deps.dev
Purl
pkg:pypi/asyncua

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.9.96

Affected versions

0.*
0.5.0
0.5.1
0.6.0
0.6.1
0.8.0
0.8.1
0.8.2
0.8.3
0.8.4
0.9.0
0.9.1
0.9.2
0.9.3
0.9.6
0.9.8
0.9.9
0.9.10
0.9.11
0.9.12
0.9.14
0.9.90
0.9.91
0.9.92
0.9.93
0.9.94
0.9.95

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-2894-qcqf-g23g/GHSA-2894-qcqf-g23g.json"