CVE-2024-8260 OPA SMB Force-Authentication

2024-08-3012:22:45

CWE-294

tenable

github.com

cve-2024-8260

opa

windows

smb

force-authentication

vulnerability

input validation

arbitrary smb share

rego file

cli

go library

CVSS3

6.1

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L

AI Score

Confidence

High

EPSS

Percentile

9.5%

SSVC

Exploitation

none

Automatable

Technical Impact

partial

JSON

A SMB force-authentication vulnerability exists in all versions of OPA for Windows prior to v0.68.0. The vulnerability exists because of improper input validation, allowing a user to pass an arbitrary SMB share instead of a Rego file as an argument to OPA CLI or to one of the OPA Go library’s functions.