Описание
SurrealDB versions before 3.1.0 contain an authorization bypass vulnerability in the KILL statement that allows authenticated database users to terminate other users' LIVE SELECT subscriptions. Attackers can issue KILL statements with target live query UUIDs to disrupt real-time data subscriptions of other users without ownership verification.
Ссылки
- Vendor AdvisoryMitigation
- Third Party Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 3.1.0 (исключая)
cpe:2.3:a:surrealdb:surrealdb:*:*:*:*:*:*:*:*
EPSS
Процентиль: 8%
0.00181
Низкий
5.4 Medium
CVSS3
Дефекты
CWE-862
Связанные уязвимости
CVSS3: 5.4
github
23 дня назад
SurrealDB versions before 3.1.0 contain an authorization bypass vulnerability in the KILL statement that allows authenticated database users to terminate other users' LIVE SELECT subscriptions. Attackers can issue KILL statements with target live query UUIDs to disrupt real-time data subscriptions of other users without ownership verification.
EPSS
Процентиль: 8%
0.00181
Низкий
5.4 Medium
CVSS3
Дефекты
CWE-862