OpenFGA 安全漏洞

OpenFGA is OpenFGA's high performance and flexible authorization/licensing engine built for developers and inspired by Google Zanzibar. A security vulnerability exists in versions of OpenFGA prior to 0.2.4 that stems from an endpoint that does not validate the authorization header, resulting in t...

CVE-2022-39342 OpenFGA Authorization Bypass

OpenFGA is an authorization/permission engine. Versions prior to version 0.2.4 are vulnerable to authorization bypass under certain conditions. Users whose model has a relation defined as a tupleset the right hand side of a ‘from’ statement that involves anything other than a direct relationship...

CVE-2022-39340

CVE-2022-39340 affects the OpenFGA authorization engine. Prior to version 0.2.4, the streaming endpoint streamed-list-objects did not validate the Authorization header, allowing disclosure of objects in the store. Affected: OpenFGA 0.2.3 and earlier, especially when exposed to the internet. Impac...

CVE-2022-39342

OpenFGA versions prior to 0.2.4 are vulnerable to an authorization bypass when a model defines a relation as a tupleset that involves anything other than a direct relationship (e.g., not just as self). Version 0.2.4 patches this issue. No exploitation details are provided in the sources. Remediat...

OpenFGA 安全漏洞

OpenFGA is OpenFGA's high performance and flexible authorization/licensing engine built for developers and inspired by Google Zanzibar. A security vulnerability exists in versions of OpenFGA prior to 0.2.4, which stems from the ease of bypassing authorization under certain circumstances...

PT-2022-24911 · Openfga · Openfga

Name of the Vulnerable Software and Affected Versions: OpenFGA versions prior to 0.2.4 Description: OpenFGA is an authorization/permission engine. The issue allows for authorization bypass under certain conditions, specifically when users have a wildcard defined on tupleset relations in their...

CVE-2022-39341 OpenFGA Authorization Bypass

OpenFGA is an authorization/permission engine. Versions prior to version 0.2.4 are vulnerable to authorization bypass under certain conditions. Users who have wildcard defined on tupleset relations in their authorization model are vulnerable. Version 0.2.4 contains a patch for this issue...

CVE-2022-39340 OpenFGA Information Disclosure

OpenFGA is an authorization/permission engine. Prior to version 0.2.4, the streamed-list-objects endpoint was not validating the authorization header, resulting in disclosure of objects in the store. Users openfga/openfga versions 0.2.3 and prior who are exposing the OpenFGA service to the intern...

CVE-2022-39341 OpenFGA Authorization Bypass

OpenFGA is an authorization/permission engine. Versions prior to version 0.2.4 are vulnerable to authorization bypass under certain conditions. Users who have wildcard defined on tupleset relations in their authorization model are vulnerable. Version 0.2.4 contains a patch for this issue...

PT-2022-24912 · Openfga · Openfga

Name of the Vulnerable Software and Affected Versions: OpenFGA versions prior to 0.2.4 Description: OpenFGA is an authorization/permission engine. The issue concerns authorization bypass under certain conditions, specifically when a relation is defined as a tupleset involving anything other than ...

OpenFGA 安全漏洞

OpenFGA is OpenFGA's high performance and flexible authorization/licensing engine built for developers and inspired by Google Zanzibar. A security vulnerability exists in versions of OpenFGA prior to 0.2.4, which stems from the ease of bypassing authorization under certain circumstances...

CVE-2022-39340 OpenFGA Information Disclosure

OpenFGA is an authorization/permission engine. Prior to version 0.2.4, the streamed-list-objects endpoint was not validating the authorization header, resulting in disclosure of objects in the store. Users openfga/openfga versions 0.2.3 and prior who are exposing the OpenFGA service to the intern...

CVE-2022-39341

OpenFGA (authorization engine) is affected by CVE-2022-39341. Versions prior to 0.2.4 are vulnerable to an authorization bypass when a wildcard (*) is defined on tupleset relations in the authorization model. The issue is fixed in version 0.2.4, which contains the patch. Affected product/componen...