CWE-863
Allowed-with-ReviewIncorrect Authorization
Abstraction: Class · Status: Incomplete
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
5678 vulnerabilities reference this CWE, most recent first.
GHSA-6MHR-52MV-6V6F
Vulnerability from github – Published: 2022-10-18 17:12 – Updated: 2022-10-18 17:12Impact
@keystone-6/core@2.2.0 || 2.3.0 users who are using the multiselect field, and provided field-level access control - are vulnerable to their field-level access control not being used.
List-level access control is NOT affected.
Field-level access control for fields other than multiselect are NOT affected.
Example, you are vulnerable if you are using field-level access control on a multiselect like the following:
const yourList = list({
access: {
// this is list-level access control, this is NOT impacted
},
fields: {
yourFieldName: multiselect({
// this is field-level access control, for multiselect fields
// this is vulnerable
access: {
create: ({ session }) => session?.data.isAdmin,
update: ({ session }) => session?.data.isAdmin,
},
options: [
{ value: 'apples', label: 'Apples' },
{ value: 'oranges', label: 'Oranges' },
],
// ...
}),
// ...
},
// ...
});
Mitigation
Please upgrade to @keystone-6/core >= 2.3.1, where this vulnerability has been closed.
Workarounds
If for some reason you cannot upgrade your dependencies, you should stop using the multiselect field.
Credits
Thanks to Marek R for reporting and submitting the pull request to fix this problem.
If you have any questions around this security advisory, please don't hesitate to contact us at security@keystonejs.com, or open an issue on GitHub.
If you have a security flaw to report for any software in this repository, please see our SECURITY policy.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "@keystone-6/core"
},
"ranges": [
{
"events": [
{
"introduced": "2.2.0"
},
{
"fixed": "2.3.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-39322"
],
"database_specific": {
"cwe_ids": [
"CWE-285",
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2022-10-18T17:12:46Z",
"nvd_published_at": "2022-10-25T17:15:00Z",
"severity": "CRITICAL"
},
"details": "#### Impact\n\n`@keystone-6/core@2.2.0 || 2.3.0` users who are using the `multiselect` field, and provided field-level access control - are vulnerable to their field-level access control not being used.\n\nList-level access control is **NOT** affected.\n\nField-level access control for fields other than `multiselect` are **NOT** affected.\n\nExample, **you are vulnerable if** you are using field-level access control on a `multiselect` like the following:\n```ts\nconst yourList = list({\n access: {\n // this is list-level access control, this is NOT impacted\n },\n fields: {\n yourFieldName: multiselect({\n // this is field-level access control, for multiselect fields\n // this is vulnerable\n access: {\n create: ({ session }) =\u003e session?.data.isAdmin,\n update: ({ session }) =\u003e session?.data.isAdmin,\n },\n options: [\n { value: \u0027apples\u0027, label: \u0027Apples\u0027 },\n { value: \u0027oranges\u0027, label: \u0027Oranges\u0027 },\n ],\n // ...\n }),\n // ...\n },\n // ...\n});\n```\n\n#### Mitigation\nPlease upgrade to `@keystone-6/core \u003e= 2.3.1`, where this vulnerability has been closed.\n\n#### Workarounds\nIf for some reason you cannot upgrade your dependencies, you should stop using the `multiselect` field.\n\n#### Credits\nThanks to [Marek R](https://github.com/marekryb) for reporting and submitting the pull request to fix this problem.\n\nIf you have any questions around this security advisory, please don\u0027t hesitate to contact us at [security@keystonejs.com](mailto:security@keystonejs.com), or [open an issue on GitHub](https://github.com/keystonejs/keystone/issues/new/choose).\n\nIf you have a security flaw to report for any software in this repository, please see our [SECURITY policy](https://github.com/keystonejs/keystone/blob/main/SECURITY.md).",
"id": "GHSA-6mhr-52mv-6v6f",
"modified": "2022-10-18T17:12:46Z",
"published": "2022-10-18T17:12:46Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/keystonejs/keystone/security/advisories/GHSA-6mhr-52mv-6v6f"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-39322"
},
{
"type": "WEB",
"url": "https://github.com/keystonejs/keystone/commit/65c6ee3deef23605fc72b80230908696a7a65e7c"
},
{
"type": "PACKAGE",
"url": "https://github.com/keystonejs/keystone"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "Field-level access-control bypass for multiselect field"
}
GHSA-6MWH-463X-C3V4
Vulnerability from github – Published: 2022-02-25 00:01 – Updated: 2023-08-08 15:31An incorrect access control issue in HMS v1.0 allows unauthenticated attackers to read and modify all PHP files.
{
"affected": [],
"aliases": [
"CVE-2022-25402"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-02-24T15:15:00Z",
"severity": "CRITICAL"
},
"details": "An incorrect access control issue in HMS v1.0 allows unauthenticated attackers to read and modify all PHP files.",
"id": "GHSA-6mwh-463x-c3v4",
"modified": "2023-08-08T15:31:44Z",
"published": "2022-02-25T00:01:03Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25402"
},
{
"type": "WEB",
"url": "https://github.com/dota-st/Vulnerability/blob/master/HMS/HMS.md"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-6MXQ-JR92-3H2R
Vulnerability from github – Published: 2026-07-22 12:32 – Updated: 2026-07-22 12:32Traefik versions 3.7.0 through 3.7.6 contain a namespace confusion vulnerability in the Kubernetes Gateway API provider. When resolving HTTPRoute.spec.rules[].backendRefs[].filters[].extensionRef, Traefik used the backend Service namespace instead of the HTTPRoute namespace. A low-privileged route author holding a ReferenceGrant for a cross-namespace Service could therefore bind a Traefik Middleware from the backend namespace without a separate grant for that middleware, potentially injecting trusted reverse-proxy identity headers into downstream requests. The issue is fixed in version 3.7.7.
{
"affected": [],
"aliases": [
"CVE-2026-65601"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-22T12:18:20Z",
"severity": "MODERATE"
},
"details": "Traefik versions 3.7.0 through 3.7.6 contain a namespace confusion vulnerability in the Kubernetes Gateway API provider. When resolving HTTPRoute.spec.rules[].backendRefs[].filters[].extensionRef, Traefik used the backend Service namespace instead of the HTTPRoute namespace. A low-privileged route author holding a ReferenceGrant for a cross-namespace Service could therefore bind a Traefik Middleware from the backend namespace without a separate grant for that middleware, potentially injecting trusted reverse-proxy identity headers into downstream requests. The issue is fixed in version 3.7.7.",
"id": "GHSA-6mxq-jr92-3h2r",
"modified": "2026-07-22T12:32:18Z",
"published": "2026-07-22T12:32:18Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/traefik/traefik/security/advisories/GHSA-qq9q-x9w4-chhj"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-65601"
},
{
"type": "WEB",
"url": "https://github.com/traefik/traefik/commit/26c96a3935cafb473f4a5bae1886560d9aa4e4f0"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/traefik-before-namespace-confusion-via-httproute-extensionref"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-6P2H-RJJ7-2J63
Vulnerability from github – Published: 2022-09-02 00:01 – Updated: 2024-05-14 21:21An authorization flaw was found in openstack-barbican, where anyone with an admin role could add secrets to a different project container. This flaw allows an attacker on the network to consume protected resources and cause a denial of service.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "barbican"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "14.0.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-23452"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2024-05-14T21:21:48Z",
"nvd_published_at": "2022-09-01T21:15:00Z",
"severity": "MODERATE"
},
"details": "An authorization flaw was found in openstack-barbican, where anyone with an admin role could add secrets to a different project container. This flaw allows an attacker on the network to consume protected resources and cause a denial of service.",
"id": "GHSA-6p2h-rjj7-2j63",
"modified": "2024-05-14T21:21:48Z",
"published": "2022-09-02T00:01:02Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23452"
},
{
"type": "WEB",
"url": "https://github.com/openstack/barbican/commit/6c841b23afa8ed6fa4cd01ba1a6bebfb60f06ae5"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2022:5114"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2022:8874"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2022-23452"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2022908"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2025090"
},
{
"type": "WEB",
"url": "https://review.opendev.org/c/openstack/barbican/+/814200"
},
{
"type": "WEB",
"url": "https://storyboard.openstack.org/#!/story/2009297"
},
{
"type": "WEB",
"url": "https://storyboard.openstack.org/#%21/story/2009297"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "openstack-barbican Denial of Service vulnerability"
}
GHSA-6P54-FW2F-Q7GF
Vulnerability from github – Published: 2026-06-11 20:26 – Updated: 2026-07-15 21:58Impact
On a DevGuard API instance with one or more public assets, any authenticated user — including users from a different organization with no membership or role in the affected org/project — can create, update, reapply, and delete VEX rules on those public assets. The same flaw affects the other vulnerability-triage write endpoints exposed under a public asset, including:
- VEX rule create / update / reapply / delete
- Dependency-vuln event creation (accept / reject / mitigate decisions), batch event creation, vuln sync, and mitigation
- License risk creation
- External reference writes
- Artifact creation and license refresh
The attacker needs a valid account on the instance, but no membership in the victim organization, project, or asset is required.
Security impact is primarily to integrity of the vulnerability picture of public assets: an attacker can mark CVEs as false-positive, silence vulnerabilities, attach misleading justifications, or delete legitimate triage rules — undermining the trustworthiness of every consumer of the affected asset's VEX/SBOM output. Because public assets are by definition consumed by third parties (downstream users, supply-chain consumers, the published vex.json/sbom.json), the blast radius extends to anyone relying on that data.
Private assets are not affected by this advisory: the public-read exemption that enables the bypass does not apply to them, and access remains correctly gated by organization/project membership. The private setting is only relevant in DevGuard itself — there is no impact given when you have an open-source project on e.g. GitLab/GitHub and a private DevGuard asset connected.
Patches
Version v1.4.2contains a patch. Users should upgrade to the patched release as soon as it is available.
Workarounds
If developers cannot upgrade their applications immediately:
- ** They should make affected assets non-public.** In the asset settings, switch visibility from public to private. This removes the public-read exemption in the access-control middleware and restores correct authorization on all write endpoints for that asset. Downstream consumers that previously relied on the public
vex.json/sbom.jsonendpoints will need to be granted explicit access or must receive an exported file version until the patched release is deployed.
Resources
Fixed commit: https://github.com/l3montree-dev/devguard/commit/1be88ec1309a5dc0566e35a23bdc4ea3ecd11417
Credit
DeevGuard thanks @philipflohr (awesome-it.de) for finding and responsibly reporting this vulnerability!
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/l3montree-dev/devguard"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.4.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-48089"
],
"database_specific": {
"cwe_ids": [
"CWE-285",
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2026-06-11T20:26:18Z",
"nvd_published_at": "2026-06-19T20:16:16Z",
"severity": "HIGH"
},
"details": "### Impact\n\nOn a DevGuard API instance with one or more **public assets**, any authenticated user \u2014 including users from a different organization with no membership or role in the affected org/project \u2014 can create, update, reapply, and delete **VEX rules** on those public assets. The same flaw affects the other vulnerability-triage write endpoints exposed under a public asset, including:\n\n- VEX rule create / update / reapply / delete\n- Dependency-vuln event creation (accept / reject / mitigate decisions), batch event creation, vuln sync, and mitigation\n- License risk creation\n- External reference writes\n- Artifact creation and license refresh\n\nThe attacker needs a valid account on the instance, but no membership in the victim organization, project, or asset is required.\n\n**Security impact** is primarily to **integrity** of the vulnerability picture of public assets: an attacker can mark CVEs as false-positive, silence vulnerabilities, attach misleading justifications, or delete legitimate triage rules \u2014 undermining the trustworthiness of every consumer of the affected asset\u0027s VEX/SBOM output. Because public assets are by definition consumed by third parties (downstream users, supply-chain consumers, the published vex.json/sbom.json), the blast radius extends to anyone relying on that data.\n\nPrivate assets are **not affected** by this advisory: the public-read exemption that enables the bypass does not apply to them, and access remains correctly gated by organization/project membership. The private setting is only relevant in DevGuard itself \u2014 there is no impact given when you have an open-source project on e.g. GitLab/GitHub and a private DevGuard asset connected.\n\n### Patches\n\nVersion `v1.4.2`contains a patch. Users should upgrade to the patched release as soon as it is available.\n\n### Workarounds\n\nIf developers cannot upgrade their applications immediately:\n\n- ** They should make affected assets non-public.** In the asset settings, switch visibility from public to private. This removes the public-read exemption in the access-control middleware and restores correct authorization on all write endpoints for that asset. Downstream consumers that previously relied on the public `vex.json` / `sbom.json` endpoints will need to be granted explicit access or must receive an exported file version until the patched release is deployed.\n\n### Resources\nFixed commit: https://github.com/l3montree-dev/devguard/commit/1be88ec1309a5dc0566e35a23bdc4ea3ecd11417\n\n### Credit\n\nDeevGuard thanks @philipflohr ([awesome-it.de](https://awesome-it.de/)) for finding and responsibly reporting this vulnerability!",
"id": "GHSA-6p54-fw2f-q7gf",
"modified": "2026-07-15T21:58:25Z",
"published": "2026-06-11T20:26:18Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/l3montree-dev/devguard/security/advisories/GHSA-6p54-fw2f-q7gf"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48089"
},
{
"type": "WEB",
"url": "https://github.com/l3montree-dev/devguard/commit/1be88ec1309a5dc0566e35a23bdc4ea3ecd11417"
},
{
"type": "PACKAGE",
"url": "https://github.com/l3montree-dev/devguard"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:N",
"type": "CVSS_V4"
}
],
"summary": "DevGuard has improper authorization on public assets"
}
GHSA-6P5J-FMWW-GQ26
Vulnerability from github – Published: 2023-08-11 03:30 – Updated: 2024-04-04 06:51Improper access control in firmware for some Intel(R) PROSet/Wireless WiFi software for Windows before version 22.220 HF (Hot Fix) may allow a privileged user to potentially enable escalation of privilege via local access.
{
"affected": [],
"aliases": [
"CVE-2023-28714"
],
"database_specific": {
"cwe_ids": [
"CWE-284",
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-08-11T03:15:25Z",
"severity": "MODERATE"
},
"details": "Improper access control in firmware for some Intel(R) PROSet/Wireless WiFi software for Windows before version 22.220 HF (Hot Fix) may allow a privileged user to potentially enable escalation of privilege via local access.",
"id": "GHSA-6p5j-fmww-gq26",
"modified": "2024-04-04T06:51:15Z",
"published": "2023-08-11T03:30:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-28714"
},
{
"type": "WEB",
"url": "http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00872.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-6P6J-F8Q6-5R72
Vulnerability from github – Published: 2025-06-09 15:31 – Updated: 2025-10-06 21:30Incorrect authorization vulnerability in TCMAN's GIM v11. This vulnerability allows an unprivileged attacker to modify the permissions held by each of the application's users, including the user himself by sending a POST request to /PC/Options.aspx?Command=2&Page=-1.
{
"affected": [],
"aliases": [
"CVE-2025-40669"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-09T13:15:22Z",
"severity": "HIGH"
},
"details": "Incorrect authorization vulnerability in TCMAN\u0027s GIM v11. This vulnerability allows an unprivileged attacker to modify the permissions held by each of the application\u0027s users, including the user himself by sending a POST request to /PC/Options.aspx?Command=2\u0026amp;Page=-1.",
"id": "GHSA-6p6j-f8q6-5r72",
"modified": "2025-10-06T21:30:44Z",
"published": "2025-06-09T15:31:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-40669"
},
{
"type": "WEB",
"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tcman-gim-1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-6P92-QFQF-QWX4
Vulnerability from github – Published: 2024-02-12 15:08 – Updated: 2024-02-12 21:35Summary
A jdbc attack vulnerability exists in OpenRefine(version<=3.7.7)
Details
Vulnerability Recurrence
Start by constructing a malicious MySQL Server (using the open source project MySQL_Fake_Server here).
Then go to the Jdbc connection trigger vulnerability
Vulnerability Analysis
This vulnerability is the bypass of CVE-2023-41887 vulnerability repair, the main vulnerability principle is actually the use of official syntax features, as shown in the following figure, when the connection we can perform parameter configuration in the Host part
In com.google.refine.extension.database.mysql.MySQLConnectionManager#getConnection method in the final JdbcUrl structure
That is, in the toURI method call here, you can see that the Host part is directly concatenated for any verification, which can be bypassed using the address feature of mysql
That is, in the toURI method call here, you can see that the Host part is directly concatenated for any verification, which can be bypassed using the address feature of mysql
PoC
Complete instructions, including specific configuration details, to reproduce the vulnerability.
Type: MySQL
Host: 127.0.0.1:3306,(host=127.0.0.1,port=3306,autoDeserialize=true,allowLoadLocalInfile=true,allowUrlInLocalInfile=true,allowLoadLocalInfileInPath=true),127.0.0.1
Port: 3306
User: win_hosts
Database: test
Impact
Due to the newer MySQL driver library in the latest version of OpenRefine (8.0.30), there is no associated deserialization utilization point, so original code execution cannot be achieved, but attackers can use this vulnerability to read sensitive files on the target server.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 3.7.7"
},
"package": {
"ecosystem": "Maven",
"name": "org.openrefine:database"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.7.8"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-23833"
],
"database_specific": {
"cwe_ids": [
"CWE-22",
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2024-02-12T15:08:48Z",
"nvd_published_at": "2024-02-12T21:15:08Z",
"severity": "HIGH"
},
"details": "### Summary\nA jdbc attack vulnerability exists in OpenRefine(version\u003c=3.7.7)\n\n### Details\n#### Vulnerability Recurrence\nStart by constructing a malicious MySQL Server (using the open source project MySQL_Fake_Server here).\n\nThen go to the Jdbc connection trigger vulnerability\n\n#### Vulnerability Analysis\nThis vulnerability is the bypass of `CVE-2023-41887` vulnerability repair, the main vulnerability principle is actually the use of official syntax features, as shown in the following figure, when the connection we can perform parameter configuration in the Host part\n\nIn `com.google.refine.extension.database.mysql.MySQLConnectionManager#getConnection` method in the final JdbcUrl structure\n\nThat is, in the ` toURI` method call here, you can see that the Host part is directly concatenated for any verification, which can be bypassed using the address feature of mysql\n\nThat is, in the toURI method call here, you can see that the Host part is directly concatenated for any verification, which can be bypassed using the address feature of mysql\n\n\n\n\n### PoC\n_Complete instructions, including specific configuration details, to reproduce the vulnerability._\n```\nType: MySQL\nHost: 127.0.0.1:3306,(host=127.0.0.1,port=3306,autoDeserialize=true,allowLoadLocalInfile=true,allowUrlInLocalInfile=true,allowLoadLocalInfileInPath=true),127.0.0.1\nPort: 3306\nUser: win_hosts\nDatabase: test\n```\n\n\n### Impact \nDue to the newer MySQL driver library in the latest version of OpenRefine (8.0.30), there is no associated deserialization utilization point, so original code execution cannot be achieved, but attackers can use this vulnerability to read sensitive files on the target server.\n",
"id": "GHSA-6p92-qfqf-qwx4",
"modified": "2024-02-12T21:35:52Z",
"published": "2024-02-12T15:08:48Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/OpenRefine/OpenRefine/security/advisories/GHSA-6p92-qfqf-qwx4"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23833"
},
{
"type": "WEB",
"url": "https://github.com/OpenRefine/OpenRefine/commit/41ccf574847d856e22488a7c0987ad8efa12a84a"
},
{
"type": "PACKAGE",
"url": "https://github.com/OpenRefine/OpenRefine"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
],
"summary": "OpenRefine JDBC Attack Vulnerability"
}
GHSA-6P9H-JQFR-2F8J
Vulnerability from github – Published: 2023-02-07 18:30 – Updated: 2024-03-21 03:34Insecure Permission vulnerability in Schlix Web Inc SCHLIX CMS 2.2.7-2 allows attacker to upload arbitrary files and execute arbitrary code via the tristao parameter.
{
"affected": [],
"aliases": [
"CVE-2022-45544"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-02-07T16:15:00Z",
"severity": "HIGH"
},
"details": "Insecure Permission vulnerability in Schlix Web Inc SCHLIX CMS 2.2.7-2 allows attacker to upload arbitrary files and execute arbitrary code via the tristao parameter.",
"id": "GHSA-6p9h-jqfr-2f8j",
"modified": "2024-03-21T03:34:45Z",
"published": "2023-02-07T18:30:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-45544"
},
{
"type": "WEB",
"url": "https://blog.tristaomarinho.com/schlix-cms-2-2-7-2-arbitrary-file-upload"
},
{
"type": "WEB",
"url": "https://github.com/tristao-marinho/CVE-2022-45544/blob/main/README.md"
},
{
"type": "WEB",
"url": "https://www.schlix.com"
},
{
"type": "WEB",
"url": "https://www.schlix.com/downloads/schlix-cms/schlix-cms-v2.2.7-2.zip"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-6PHJ-QQ4X-GR48
Vulnerability from github – Published: 2023-04-25 21:30 – Updated: 2024-04-04 03:41On affected platforms running Arista EOS, an authorized attacker with permissions to perform gNMI requests could craft a request allowing it to update arbitrary configurations in the switch. This situation occurs only when the Streaming Telemetry Agent (referred to as the TerminAttr agent) is enabled and gNMI access is configured on the agent. Note: This gNMI over the Streaming Telemetry Agent scenario is mostly commonly used when streaming to a 3rd party system and is not used by default when streaming to CloudVision
{
"affected": [],
"aliases": [
"CVE-2023-24512"
],
"database_specific": {
"cwe_ids": [
"CWE-284",
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-04-25T21:15:10Z",
"severity": "MODERATE"
},
"details": "On affected platforms running Arista EOS, an authorized attacker with permissions to perform gNMI requests could craft a request allowing it to update arbitrary configurations in the switch. This situation occurs only when the Streaming Telemetry Agent (referred to as the TerminAttr agent) is enabled and gNMI access is configured on the agent. Note: This gNMI over the Streaming Telemetry Agent scenario is mostly commonly used when streaming to a 3rd party system and is not used by default when streaming to CloudVision",
"id": "GHSA-6phj-qq4x-gr48",
"modified": "2024-04-04T03:41:15Z",
"published": "2023-04-25T21:30:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-24512"
},
{
"type": "WEB",
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/17250-security-advisory-0086"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
- Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
- Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Mitigation MIT-4.4
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
- For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
- One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
No CAPEC attack patterns related to this CWE.