Veracode Vulnerability DatabaseVERACODE:43572Authentication Bypass
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
0.002 Low
EPSS
Percentile
54.5%
github.com/charmbracelet/soft-serve is vulnerable to Authentication Bypass. The vulnerability exists when the public key setting allow-keyless is true which allows an attacker to perform unauthorized actions.
| CPE | Name | Operator | Version |
|---|---|---|---|
| github.com/charmbracelet/soft-serve | le | v0.6.1 | |
| github.com/charmbracelet/soft-serve | le | v0.6.1 |
References
github.com/advisories/GHSA-mc97-99j4-vm2v
github.com/charmbracelet/soft-serve/commit/407c4ec72d1006cee1ff8c1775e5bcc091c2bc89
github.com/charmbracelet/soft-serve/issues/389
github.com/charmbracelet/soft-serve/releases/tag/v0.6.2
github.com/charmbracelet/soft-serve/security/advisories/GHSA-mc97-99j4-vm2v
Related
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
0.002 Low
EPSS
Percentile
54.5%