Описание
SurrealDB versions before 3.1.0 fail to enforce table SELECT permissions when traversing graph edges or back-references. Authenticated users can read records from any table reachable through graph edges regardless of the target table's PERMISSIONS FOR select clause.
Ссылки
- Vendor AdvisoryMitigation
- Third Party Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 3.1.0 (исключая)
cpe:2.3:a:surrealdb:surrealdb:*:*:*:*:*:*:*:*
EPSS
Процентиль: 21%
0.00287
Низкий
6.5 Medium
CVSS3
Дефекты
CWE-200
Связанные уязвимости
CVSS3: 6.5
github
22 дня назад
SurrealDB versions before 3.1.0 fail to enforce table SELECT permissions when traversing graph edges or back-references. Authenticated users can read records from any table reachable through graph edges regardless of the target table's PERMISSIONS FOR select clause.
EPSS
Процентиль: 21%
0.00287
Низкий
6.5 Medium
CVSS3
Дефекты
CWE-200