GHSA-5rc4-v5mj-g8c4

Source

https://github.com/advisories/GHSA-5rc4-v5mj-g8c4

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/09/GHSA-5rc4-v5mj-g8c4/GHSA-5rc4-v5mj-g8c4.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-5rc4-v5mj-g8c4

Aliases

CVE-2022-32169

Published

2022-09-29T00:00:27Z

Modified

2023-11-01T04:59:06.108818Z

Severity

4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator

Summary

Bytebase does not restrict low privilege user to access admin issues

Details

The Bytebase application does not restrict low privilege user to access admin issues for which an unauthorized user can view the OPEN and CLOSED issues by Admin and the affected endpoint is /issue.

Database specific

{
    "nvd_published_at": "2022-09-28T10:15:00Z",
    "github_reviewed_at": "2022-10-04T21:42:30Z",
    "severity": "MODERATE",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-732"
    ]
}

References

Affected packages

Go / github.com/bytebase/bytebase

Package

Name: github.com/bytebase/bytebase; View open source insights on deps.dev
Purl: pkg:golang/github.com/bytebase/bytebase

Affected ranges

Type: SEMVER
Events: Introduced

0.1.0

Last affected

1.0.4