CVE-2022-23542

2022-12-2021:15:10

CWE-285

[email protected]

web.nvd.nist.gov

openfga

authorization bypass

cve-2022-23542

security vulnerability

patch

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.4 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

54.2%

JSON

OpenFGA is an authorization/permission engine built for developers and inspired by Google Zanzibar. During an internal security assessment, it was discovered that OpenFGA version 0.3.0 is vulnerable to authorization bypass under certain conditions. This issue has been patched in version 0.3.1 and is backward compatible.

Affected configurations

Vulners

NVD

Node

openfgaopenfgaMatch0.3.0

VendorProductVersionCPE
openfgaopenfga0.3.0cpe:2.3:a:openfga:openfga:0.3.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
openfga	openfga	0.3.0	cpe:2.3:a:openfga:openfga:0.3.0:::::::*

CNA Affected

[
  {
    "vendor": "openfga",
    "product": "openfga",
    "versions": [
      {
        "version": "= 0.3.0",
        "status": "affected"
      }
    ]
  }
]