GitHub Advisoryadvisory · RubyGems
GHSA-8jhx-9gf4-hhf5 Consul gem insufficient authentication check - Multiple powers in one controller are not always checked correctly
CRITICAL
Official page ↗
- Aliases
- CVE-2019-16377
- Ecosystem
- RubyGems
- Packages
- consul
- Severity
- Critical
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-284
- Reviewed
- 2019-09-25
Affected packages
• RubyGems consul: < 1.0.3 → fixed in 1.0.3
Description
With the consul ruby gem before 1.0.3, if a controller checks multiple powers using `:if` or `:except` conditions, these conditions are erroneously applied to all power checks in that controller. This can lead to skipped power checks and hence unauthenticated access to certain controller actions.
Related
Alias · CVE (1)
- CVE-2019-16377 The makandra consul gem through 1.0.2 for Ruby has Incorrect Access Control. vulnerability
Weakness · CWE (1)
- CWE-284 Improper Access Control weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2019-16377 advisory
- https://github.com/makandra/consul/issues/49 web
- https://github.com/makandra/consul package
- https://github.com/rubysec/ruby-advisory-db/blob/c26fbc13435b8be448ad59131428538049d165e4/gems/consul/CVE-2019-16377.yml web
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/consul/CVE-2019-16377.yml web
- https://rubygems.org/gems/consul web