fkie_cve-2024-32001
Vulnerability from fkie_nvd
Published
2024-04-10 23:15
Modified
2024-11-21 09:14
Severity ?
Summary
SpiceDB is a graph database purpose-built for storing and evaluating access control data. Use of a relation of the form: `relation folder: folder | folder#parent` with an arrow such as `folder->view` can cause LookupSubjects to only return the subjects found under subjects for either `folder` or `folder#parent`. This bug only manifests if the same subject type is used multiple types in a relation, relationships exist for both subject types and an arrow is used over the relation. Any user making a negative authorization decision based on the results of a LookupSubjects request with version before v1.30.1 is affected. Version 1.30.1 contains a patch for the issue. As a workaround, avoid using LookupSubjects for negative authorization decisions and/or avoid using the broken schema.
References
Impacted products
| Vendor | Product | Version |
|---|
{
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "SpiceDB is a graph database purpose-built for storing and evaluating access control data. Use of a relation of the form: `relation folder: folder | folder#parent` with an arrow such as `folder-\u003eview` can cause LookupSubjects to only return the subjects found under subjects for either `folder` or `folder#parent`. This bug only manifests if the same subject type is used multiple types in a relation, relationships exist for both subject types and an arrow is used over the relation. Any user making a negative authorization decision based on the results of a LookupSubjects request with version before v1.30.1 is affected. Version 1.30.1 contains a patch for the issue. As a workaround, avoid using LookupSubjects for negative authorization decisions and/or avoid using the broken schema.\n"
},
{
"lang": "es",
"value": "SpiceDB es una base de datos gr\u00e1fica manipulada espec\u00edficamente para almacenar y evaluar datos de control de acceso. Uso de una relaci\u00f3n de la forma: `relation folder: folder | folder#parent` con una flecha como `folder-\u0026gt;view` puede hacer que LookupSubjects solo devuelva los asuntos encontrados en los asuntos de `folder` o `folder#parent`. Este error solo se manifiesta si el mismo tipo de asunto se usa en varios tipos en una relaci\u00f3n, existen relaciones para ambos tipos de asunto y se usa una flecha sobre la relaci\u00f3n. Cualquier usuario que tome una decisi\u00f3n de autorizaci\u00f3n negativa basada en los resultados de una solicitud de LookupSubjects con una versi\u00f3n anterior a la v1.30.1 se ver\u00e1 afectado. La versi\u00f3n 1.30.1 contiene un parche para el problema. Como workaround, evite el uso de LookupSubjects para decisiones de autorizaci\u00f3n negativas y/o evite el uso del esquema roto."
}
],
"id": "CVE-2024-32001",
"lastModified": "2024-11-21T09:14:19.137",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 2.2,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 0.7,
"impactScore": 1.4,
"source": "security-advisories@github.com",
"type": "Secondary"
}
]
},
"published": "2024-04-10T23:15:07.363",
"references": [
{
"source": "security-advisories@github.com",
"url": "https://github.com/authzed/spicedb/commit/a244ed1edfaf2382711dccdb699971ec97190c7b"
},
{
"source": "security-advisories@github.com",
"url": "https://github.com/authzed/spicedb/releases/tag/v1.30.1"
},
{
"source": "security-advisories@github.com",
"url": "https://github.com/authzed/spicedb/security/advisories/GHSA-j85q-46hg-36p2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://github.com/authzed/spicedb/commit/a244ed1edfaf2382711dccdb699971ec97190c7b"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://github.com/authzed/spicedb/releases/tag/v1.30.1"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://github.com/authzed/spicedb/security/advisories/GHSA-j85q-46hg-36p2"
}
],
"sourceIdentifier": "security-advisories@github.com",
"vulnStatus": "Awaiting Analysis",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-755"
}
],
"source": "security-advisories@github.com",
"type": "Secondary"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…