PT-2024-40015 · Surrealdb · Surrealdb

Published 2024-12-16 · Updated 2024-12-16

Positive Technologies (AI Summary)

CVSS v4.0

2.3

Low

Base vector

AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions SurrealDB versions prior to 2.1.4

Description The issue concerns the OVERWRITE clause of the DEFINE TABLE statement, which fails to overwrite data for tables defined with TYPE RELATION. This failure affects the PERMISSIONS clause, potentially leading users to believe they have changed table permissions when they have not. As a result, a client authorized to run queries in a SurrealDB server may access certain data in a specific table that they were not intended to access after the specified change in permissions.

Recommendations For versions prior to 2.1.4, users are advised to verify that the intended permissions are in place using the INFO FOR DB statement. If updating permissions in a table with TYPE RELATION is required, affected users will need to remove the table and define it from scratch with the intended permissions, preserving data by backing it up to a temporary table.

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

GHSA-27VQ-HV74-7CQP

Affected Products

Surrealdb

References · 5

• https://osv.dev/vulnerability/GHSA-27vq-hv74-7cqp · Vendor Advisory
• https://github.com/surrealdb/surrealdb · Note
• https://github.com/surrealdb/surrealdb/commit/2f9a58f830c24f107b4783da1f0704a502bc7734 · Note
• https://github.com/surrealdb/surrealdb/pull/5260 · Note
• https://github.com/surrealdb/surrealdb/security/advisories/GHSA-27vq-hv74-7cqp · Note