Lucene search

GoogleOSV:CVE-2022-23542

HistoryDec 20, 2022 - 9:15 p.m.

CVE-2022-23542

2022-12-2021:15:10

Google

osv.dev

openfga

authorization bypass

vulnerability

security assessment

patch

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.5 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

54.2%

JSON

OpenFGA is an authorization/permission engine built for developers and inspired by Google Zanzibar. During an internal security assessment, it was discovered that OpenFGA version 0.3.0 is vulnerable to authorization bypass under certain conditions. This issue has been patched in version 0.3.1 and is backward compatible.

CPENameOperatorVersion
openfgaeq0.2.1
openfgaeq0.2.3
openfgaeq0.1.1
openfgaeq0.1.3
openfgaeq0.1.6
openfgaeq0.2.0
openfgaeq0.2.2
openfgaeq0.1.5
openfgaeq0.3.0
openfgaeq0.1.0

Name	Operator	Version
openfga	eq	0.2.1
openfga	eq	0.2.3
openfga	eq	0.1.1
openfga	eq	0.1.3
openfga	eq	0.1.6
openfga	eq	0.2.0
openfga	eq	0.2.2
openfga	eq	0.1.5
openfga	eq	0.3.0
openfga	eq	0.1.0

Rows per page:

1-10 of 151

References

github.com/openfga/openfga/pull/422

github.com/openfga/openfga/releases/tag/v0.3.1

github.com/openfga/openfga/security/advisories/GHSA-m3q4-7qmj-657m

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.5 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

54.2%

JSON

Related for OSV:CVE-2022-23542