PT-2020-18379 · Elide · Elide
Highaklish
·
Published
2020-03-30
·
Updated
2020-04-01
·
CVE-2020-5289
CVSS v3.1
6.8
Medium
| Vector | AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Elide versions prior to 4.5.14
Description
It is possible for an adversary to "guess and check" the value of a model field they do not have access to, assuming they can read at least one other field in the model. The adversary can construct filter expressions for an inaccessible field to filter a collection. The presence or absence of models in the returned collection can be used to reconstruct the value of the inaccessible field. For example, using a filter like
filter=role=="Admin" on a User model, the adversary can determine which users have an admin role by presence or absence in the returned collection.Recommendations
For versions prior to 4.5.14, update to Elide 4.5.14 or greater to resolve the issue.
As a temporary workaround, consider restricting read permissions on existing models to prevent access to fields with different permission levels.
Fix
Improper Authorization
Files Accessible to External Parties
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Elide