PT-2024-17934 · Unknown · Kinto-Attachment

Published 2024-02-08 · Updated 2024-02-08 · CVE-2024-1314

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions kinto-attachment versions prior to 6.4.0

Description The issue allows an attachment file of an existing record to be replaced if a user has read permission on one of the parent collections or buckets. Furthermore, if the read permission is granted to system.Everyone on one of the parents, an attachment can be replaced on a record using an anonymous request. Records' attachments are safe only if the parent has no explicit read permission.

Recommendations For versions prior to 6.4.0, update to version 6.4.0 or apply the patch individually to resolve the issue. As a temporary workaround, consider restricting read permission on parent collections or buckets to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2024-1314

GHSA-HVP4-VRV2-8WRQ

Affected Products

Kinto-Attachment

References · 5

• https://osv.dev/vulnerability/GHSA-hvp4-vrv2-8wrq · Vendor Advisory
• https://github.com/Kinto/kinto-attachment · Note
• https://github.com/Kinto/kinto-attachment/security/advisories/GHSA-hvp4-vrv2-8wrq · Note
• https://github.com/Kinto/kinto-attachment/commit/f4a31484f5925cbc02b59ebd37554538ab826ca1 · Note
• https://bugzilla.mozilla.org/show_bug.cgi?id=1879034 · Note