Consul gem insufficient authentication check - Multiple powers in one controller are not always checked correctly

2019-09-2720:01:00

Google

osv.dev

0.006 Low

EPSS

Percentile

79.3%

JSON

With the consul ruby gem before 1.0.3, if a controller checks multiple powers using :if or :except conditions, these conditions are erroneously applied to all power checks in that controller. This can lead to skipped power checks and hence unauthenticated access to certain controller actions.

CPENameOperatorVersion
consuleq0.10.2
consuleq0.12.3
consuleq1.0.2
consuleq0.14.1
consuleq0.7.0
consuleq0.1.1
consuleq0.1.0
consuleq0.1.2
consuleq0.11.1
consuleq0.2.3