Authorization Bypass

2022-06-1508:03:03

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.0004 Low

EPSS

Percentile

5.1%

JSON

github.com/edgexfoundry/edgex-go and github.com/edgexfoundry/device-sdk-go are vulnerable to authorization bypass. The vulnerability exists in BootstrapHandler function in messaging.go because it doesn’t remove MessageBus Options data from configuration after creating a message client which allows an attacker to bypass access controls and gain access to sensitive information.

CPENameOperatorVersion
github.com/edgexfoundry/device-sdk-golev2.1.1
github.com/edgexfoundry/edgex-goeqv2.1.1
github.com/edgexfoundry/edgex-golev2.1.1-dev.8
github.com/edgexfoundry/edgex-golev2.1.0
github.com/edgexfoundry/device-sdk-golev2.1.1
github.com/edgexfoundry/edgex-goeqv2.1.1
github.com/edgexfoundry/edgex-golev2.1.1-dev.8
github.com/edgexfoundry/edgex-golev2.1.0

Name	Operator	Version
github.com/edgexfoundry/device-sdk-go	le	v2.1.1
github.com/edgexfoundry/edgex-go	eq	v2.1.1
github.com/edgexfoundry/edgex-go	le	v2.1.1-dev.8
github.com/edgexfoundry/edgex-go	le	v2.1.0
github.com/edgexfoundry/device-sdk-go	le	v2.1.1
github.com/edgexfoundry/edgex-go	eq	v2.1.1
github.com/edgexfoundry/edgex-go	le	v2.1.1-dev.8
github.com/edgexfoundry/edgex-go	le	v2.1.0