CVE-2023-35930

2023-06-2620:15:10

CWE-913

GitHub_M

web.nvd.nist.gov

spicedb

cve-2023-35930

security-critical

database system

authorization

bug fix

upgrade

negative authorization

nvd

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

AI Score

Confidence

High

EPSS

0.001

Percentile

32.8%

JSON

SpiceDB is an open source, Google Zanzibar-inspired, database system for creating and managing security-critical application permissions. Any user making a negative authorization decision based on the results of a LookupResources request with 1.22.0 is affected. For example, using LookupResources to find a list of resources to allow access to be okay: some subjects that should have access to a resource may not. But if using LookupResources to find a list of banned resources instead, then some users that shouldn’t have access may. Generally, LookupResources is not and should not be to gate access in this way - that’s what the Check API is for. Additionally, version 1.22.0 has included a warning about this bug since its initial release. Users are advised to upgrade to version 1.22.2. Users unable to upgrade should avoid using LookupResources for negative authorization decisions.

Affected configurations

Nvd

Vulners

Node

authzedspicedbMatch1.22.0-

VendorProductVersionCPE
authzedspicedb1.22.0cpe:2.3:a:authzed:spicedb:1.22.0:-:*:*:*:*:*:*

Vendor	Product	Version	CPE
authzed	spicedb	1.22.0	cpe:2.3:a:authzed:spicedb:1.22.0:-::::::

CNA Affected

[
  {
    "vendor": "authzed",
    "product": "spicedb",
    "versions": [
      {
        "version": "= 1.22.0",
        "status": "affected"
      }
    ]
  }
]