GHSA-95x7-mh78-7w2r

Source

https://github.com/advisories/GHSA-95x7-mh78-7w2r

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/10/GHSA-95x7-mh78-7w2r/GHSA-95x7-mh78-7w2r.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-95x7-mh78-7w2r

Aliases

Published

2022-10-25T20:13:38Z

Modified

2024-08-21T16:28:43Z

Severity

5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator

Summary

OpenFGA subject to Information Disclosure via streamed-list-objects endpoint

Details

Overview

During our internal security assessment, it was discovered that streamed-list-objects endpoint was not validating the authorization header resulting in the disclosure of objects in the store.

Am I Affected?

You are affected by this vulnerability if you are using openfga/openfga version v0.2.3 or prior and you are exposing the OpenFGA service to the internet.

How to fix that?

Upgrade to version v0.2.4.

Backward Compatibility

This update is backward compatible.

Database specific

{
    "cwe_ids":  [
        "CWE-285",
        "CWE-862",
        "CWE-863"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2022-10-25T20:13:38Z",
    "nvd_published_at":  "2022-10-25T17:15:00Z",
    "severity":  "MODERATE"
}

References

Affected packages

Go / github.com/openfga/openfga

Package

Name: github.com/openfga/openfga; View open source insights on deps.dev
Purl: pkg:golang/github.com/openfga/openfga

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.2.4

Database specific

last_known_affected_version_range

"<= 0.2.3"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/10/GHSA-95x7-mh78-7w2r/GHSA-95x7-mh78-7w2r.json"