PT-2022-27071 · Unknown · Stackstorm

Guilherme Murad Pim · Published 2022-12-05 · Updated 2022-12-07 · CVE-2022-44009

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions StackStorm version 3.7.0

Description The issue is related to improper access control in Key-Value RBAC, where permissions in Jinja filters are not checked, allowing attackers to access Key-Value pairs of other users. This could potentially lead to the exposure of sensitive information.

Recommendations For StackStorm version 3.7.0, consider restricting access to Key-Value pairs until a patch is available, and review the permissions in Jinja filters to ensure proper access control. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2022-44009

Affected Products

Stackstorm

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2022-44009 · Security Note
• https://stackstorm.com/2022/12/v3-8-0-released · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-44009 · Vendor Advisory
• https://t.me/cvenotify/39352 · Telegram Post