PT-2024-32323 · Spicedb · Spicedb

Tim-Mod · Published 2024-09-18 · Updated 2024-09-25 · CVE-2024-46989

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions spicedb versions prior to 1.35.3

Description The issue arises when multiple caveats are applied over the same indirect subject type on the same relation, potentially resulting in no permission being returned when permission is expected. This can occur if a resource has multiple groups, and each group is caveated. The CheckPermission API may return NO PERMISSION when PERMISSION is expected.

Recommendations For versions prior to 1.35.3, upgrade to release version 1.35.3 to address the issue. As a temporary workaround for users unable to upgrade, consider not using caveats or avoiding the use of caveats on an indirect subject type with multiple entries.

Exploit

Fix

Improper Privilege Management

Improper Authorization

Weakness Enumeration

CWE-269

CWE-285

Related Identifiers

CVE-2024-46989

GHSA-JHG6-6QRX-38MR

GO-2024-3131

Affected Products

Spicedb

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/46xxx/CVE-2024-46989.json · Exploit
• https://github.com/authzed/spicedb/commit/d4ef8e1dbce1eafaf25847f4c0f09738820f5bf2 · Patch
• https://osv.dev/vulnerability/GO-2024-3131 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-46989 · Security Note
• https://osv.dev/vulnerability/CVE-2024-46989 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-jhg6-6qrx-38mr · Vendor Advisory
• https://github.com/authzed/spicedb · Note
• https://github.com/authzed/spicedb/commit/20855de75812bcbc975efebe7f76abf47c0f3edb · Note
• https://github.com/authzed/spicedb/security/advisories/GHSA-jhg6-6qrx-38mr · Note
• https://twitter.com/CVEnew/status/1836534053383680508 · Twitter Post
• https://t.me/cvedetector/6007 · Telegram Post