Authentication Bypass

2022-06-0202:32:37

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

bleve

authentication bypass

vulnerability

role-based access control

rest handlers

directory manipulation

EPSS

Percentile

12.6%

JSON

github.com/blevesearch/bleve is vulnerable to authentication bypass. The vulnerability exists due to the missing role-based access control for rest handlers in index_create.go and index_delete.go, allowing an attacker to recursively write and delete any directory in the server by using the same account.