Improper Access Control

2024-07-1007:05:49

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

github repository

improper access control

deduplication

global cache mechanism

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

AI Score

6.6

Confidence

Low

JSON

github.com/project-zot/zot is vulnerable to Improper Access Control. The vulnerability is due to improper access control enforcement when deduplication is enabled. An attacker can read blobs (both config and layers) by digest from repositories they do not have access to by exploiting the global cache mechanism.