Lucene search

K
githubGitHub Advisory DatabaseGHSA-RF54-7QRR-96J6
HistoryOct 16, 2023 - 2:31 p.m.

vantage6 does not properly delete linked resources when deleting a collaboration

2023-10-1614:31:39
CWE-200
GitHub Advisory Database
github.com
5
vantage6
collaboration
deletion
linked resources
data disclosure

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

0.001 Low

EPSS

Percentile

20.3%

When a collaboration is deleted in vantage6, the linked resources (such as tasks from that collaboration) are not properly deleted.

This is partly to manage data properly, but also to prevent a potential (but unlikely) side-effect, where if a collaboration with id=10 is deleted, and subsequently a new collaboration is created with id=10, the authenticated users in that collaboration could potentially see results of the deleted collaboration in some cases, resulting in information disclosure.

Affected configurations

Vulners
Node
vantage6vantage6Range<4.0.0
CPENameOperatorVersion
vantage6lt4.0.0

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

0.001 Low

EPSS

Percentile

20.3%

Related for GHSA-RF54-7QRR-96J6