BIT-scylladb-2023-33972

2024-05-1414:38:04

Google

osv.dev

scylladb

nosql

data store

vulnerability

table access

escalation

seastar framework

apache cassandra

authenticated users

authorized

create tables

keyspace

privileges

permissions

patch

workaround

disable privileges

7.2 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

18.2%

JSON

Scylladb is a NoSQL data store using the seastar framework, compatible with Apache Cassandra. Authenticated users who are authorized to create tables in a keyspace can escalate their privileges to access a table in the same keyspace, even if they don’t have permissions for that table. This issue has not yet been patched. A workaround to address this issue is to disable CREATE privileges on a keyspace, and create new tables on behalf of other users.