CVE-2020-5289

Katalog CVE

CVSS 6.5 · Medium EPSS 1,3%

Kerentanan Improper Authorization pada elide. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

In Elide before 4.5.14, it is possible for an adversary to "guess and check" the value of a model field they do not have access to assuming they can read at least one other field in the model. The adversary can construct filter expressions for an inaccessible field to filter a collection. The presence or absence of models in the returned collection can be used to reconstruct the value of the inaccessible field. Resolved in Elide 4.5.14 and greater.

Rincian

Terbit di NVD

30 Maret 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-285: Improper Authorization
CWE-552: Files or Directories Accessible to External Parties

EPSS (30 hari)

1,3% peluang dieksploitasi; lebih tinggi dari 68,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/yahoo/elide/pull/1236 patch · advisory pihak ketiga
• https://github.com/yahoo/elide/pull/1236/commits/a985f0f9c448aabe70bc904337096399de4576dc patch
• https://github.com/yahoo/elide/security/advisories/GHSA-2mxr-89gf-rc4v advisory pihak ketiga