Authentication flaw

2018-02-0616:29:00

PRIOn knowledge base

www.prio-n.com

9.2 High

AI Score

Confidence

High

0.012 Low

EPSS

Percentile

85.0%

A remote attacker could bypass the Sandstorm organization restriction before build 0.203 via a comma in an email-address field.

CPENameOperatorVersion
sandstormlt0.203

CPE	Name	Operator	Version
	sandstorm	lt	0.203

References

devco.re/blog/2018/01/26/Sandstorm-Security-Review-CVE-2017-6200-en/

github.com/sandstorm-io/sandstorm/blob/v0.202/shell/packages/sandstorm-db/db.js

github.com/sandstorm-io/sandstorm/commit/37bd9a7f4eb776cdc2d3615f0bfea1254b66f59d

sandstorm.io/news/2017-03-02-security-review