CVE-2022-32170
Assigner: Mend
Published: 2022-09-21T00:00:00
State: PUBLISHED
affected: product: bytebase
vendor: bytebase
versions: lessThan: unspecified
status: affected
version: 0.1.0
versionType: custom
lessThanOrEqual: 1.0.4
status: affected
version: unspecified
versionType: custom
credits: value: Mend Vulnerability Research Team (MVR)
datePublic: 2022-09-21T00:00:00
descriptions: value: The “Bytebase” application does not restrict low privilege user to access admin “projects“ for which an unauthorized user can view the “projects“ created by “Admin” and the affected endpoint is “/api/project?user=${userId}”.
metrics: other: content: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
version: 3.1
type: unknown
problemTypes: descriptions: cweId: CWE-285
description: CWE-285 Improper Authorization
type: CWE
source: advisory: https://www.mend.io/vulnerability-database/
discovery: UNKNOWN
title: bytebase - Improper Authorization
x_generator: engine: Vulnogram 0.0.9