PT-2023-25388 · Spicedb · Spicedb

Lowecordell · Publicado 2023-06-26 · Atualizado 2024-08-20 · CVE-2023-35930

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Baixa

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions SpiceDB version 1.22.0

Description The issue affects users making negative authorization decisions based on the results of a LookupResources request. This can lead to incorrect access control, where some subjects may not have access to resources they should, or some users may have access to resources they should not. The LookupResources function is not intended for gating access and should be used in conjunction with the Check API. Version 1.22.0 includes a warning about this bug. Users are advised to upgrade to version 1.22.2 to resolve the issue.

Recommendations For SpiceDB version 1.22.0, upgrade to version 1.22.2 to resolve the issue. If unable to upgrade, avoid using LookupResources for negative authorization decisions as a temporary workaround.

Exploit

Correção

Enumeração de Fraquezas

CWE-913

Identificadores relacionados

CVE-2023-35930

GHSA-M54H-5X5F-5M6R

GO-2023-1871

Produtos afetados

Spicedb

Referências · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/35xxx/CVE-2023-35930.json · Exploit
• https://github.com/authzed/spicedb · Nota
• https://github.com/authzed/spicedb/security/advisories/GHSA-m54h-5x5f-5m6r · Aviso do Fabricante
• https://github.com/authzed/spicedb/pull/1397 · Aviso do Fabricante
• https://github.com/authzed/spicedb/releases/tag/v1.22.2 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-35930 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-35930 · Aviso do Fabricante
• https://osv.dev/vulnerability/GO-2023-1871 · Aviso do Fabricante
• https://t.me/cvenotify/53052 · Publicação no Telegram
• https://osv.dev/vulnerability/GHSA-m54h-5x5f-5m6r · Aviso do Fabricante