CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:S/C:P/I:P/A:N
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
EPSS
Percentile
38.1%
Any user making use of a wildcard relationship under the right hand branch of an exclusion
or within an intersection
operation will see Lookup
/LookupResources
return a resource as “accessible” if it is not accessible by virtue of the inclusion of the wildcard in the intersection or the right side of the exclusion.
For example, given schema:
definition user {}
definition resource {
relation viewer: user
relation banned: user | user:*
permission view = viewer - banned
}
If user:*
is placed into the banned
relation for a particular resource, view
should return false for all resources. in v1.3.0
, the wildcard is ignored entirely in lookup’s dispatch, resulting in the banned
wildcard being ignored in the exclusion.
Don’t make use of wildcards on the right side of intersections or within exclusions.
https://github.com/authzed/spicedb/issues/358
If you have any questions or comments about this advisory:
github.com/advisories/GHSA-7p8f-8hjm-wm92
github.com/authzed/spicedb/commit/15bba2e2d2a4bda336a37a7fe8ef8a35028cd970
github.com/authzed/spicedb/issues/358
github.com/authzed/spicedb/releases/tag/v1.4.0
github.com/authzed/spicedb/security/advisories/GHSA-7p8f-8hjm-wm92
nvd.nist.gov/vuln/detail/CVE-2022-21646
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:S/C:P/I:P/A:N
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
EPSS
Percentile
38.1%