CVE-2022-31022

🗓️ 01 Jun 2022 19:45:12Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 3 Media mentions👁 359 Views🌐 WEB

Bleve's HTTP package in Go allows unauthorized access to filesystem for index manipulation

Reporter	Title	Published	Views	Family All 82
Chainguard	CVE-2022-31022 vulnerabilities	1 Jun 202220:15	–	cgr
Circl	CVE-2022-31022	2 Jun 202200:24	–	circl
CNNVD	Bleve security vulnerabilities	1 Jun 202200:00	–	cnnvd
Cvelist	CVE-2022-31022 Missing Role Based Access Control for the REST handlers in bleve/http package	1 Jun 202219:45	–	cvelist
EUVD	EUVD-2022-6017	3 Oct 202520:07	–	euvd
Github Security Blog	Missing Role Based Access Control for the REST handlers in bleve/http package	3 Jun 202222:17	–	github
Mend	CVE-2022-31022	1 Jun 202219:45	–	mend
NVD	CVE-2022-31022	1 Jun 202220:15	–	nvd
OPENSUSE Linux	govulncheck-vulndb-0.0.20250612T141001-1.1 on GA media (moderate)	5 Jul 202500:00	–	opensuse
osv_cga	CGA-29FJ-4529-9RXG	14 May 202508:31	–	osv_cga

NVD

Vulners

Node

couchbase bleveRange0.1.0≥

[
  {
    "vendor": "blevesearch",
    "product": "bleve",
    "versions": [
      {
        "version": ">= 0.1.0, < 2.5.0",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/blevesearch/bleve/commit/1c7509d6a17d36f265c90b4e8f4e3a3182fe79ff
github	www.github.com/blevesearch/bleve/security/advisories/GHSA-9w9f-6mg8-jp7w
github	www.github.com/blevesearch/bleve/commit/af9e3111dadfedf9d30f0448506b4a57fecc8550

Parameter	Position	Path	Description	CWE
index_name	path	/index	The CreateIndexHandler allows an attacker to create a bleve index (directory structure) anywhere the user has write permissions due to lack of RBAC.	CWE-288, CWE-306
index_name	path	/delete	The DeleteIndexHandler allows an attacker to recursively delete any directory owned by the same user account due to lack of RBAC.	CWE-288, CWE-306