GitHub Advisoryadvisory · Go

GHSA-95x7-mh78-7w2r OpenFGA subject to Information Disclosure via streamed-list-objects endpoint

MEDIUM Published 2022-10-25 Modified 2022-10-27 Official page ↗
Aliases
CVE-2022-39340
Ecosystem
Go
Packages
github.com/openfga/openfga
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-285, CWE-862, CWE-863
Reviewed
2022-10-25

Affected packages

• Go github.com/openfga/openfga: < 0.2.4 → fixed in 0.2.4

Description

Overview During our internal security assessment, it was discovered that `streamed-list-objects` endpoint was not validating the authorization header resulting in the disclosure of objects in the store. Am I Affected? You are affected by this vulnerability if you are using `openfga/openfga` version `v0.2.3` or prior and you are exposing the OpenFGA service to the internet. How to fix that? Upgrade to version `v0.2.4`. Backward Compatibility This update is backward compatible.

Related

Alias · CVE (1)

  • CVE-2022-39340 OpenFGA is an authorization/permission engine. vulnerability

Weakness · CWE (3)

  • CWE-285 Improper Authorization weakness
  • CWE-862 Missing Authorization weakness
  • CWE-863 Incorrect Authorization weakness

References