CVE-2022-21646

Katalog CVE

CVSS 8.1 · High EPSS 1,3%

Kerentanan Improper Input Validation pada authzed spicedb. Skor CVSS 3.1 8.1 (High) menurut NVD.

Deskripsi (NVD)

SpiceDB is a database system for managing security-critical application permissions. Any user making use of a wildcard relationship under the right hand branch of an `exclusion` or within an `intersection` operation will see `Lookup`/`LookupResources` return a resource as "accessible" if it is *not* accessible by virtue of the inclusion of the wildcard in the intersection or the right side of the exclusion. In `v1.3.0`, the wildcard is ignored entirely in lookup's dispatch, resulting in the `banned` wildcard being ignored in the exclusion. Version 1.4.0 contains a patch for this issue. As a workaround, don't make use of wildcards on the right side of intersections or within exclusions.

Rincian

Terbit di NVD

11 Januari 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.1 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation
CWE-155: Improper Neutralization of Wildcards or Matching Symbols

EPSS (30 hari)

1,3% peluang dieksploitasi; lebih tinggi dari 69,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/authzed/spicedb/commit/15bba2e2d2a4bda336a37a7fe8ef8a35028cd970 patch · advisory pihak ketiga
• https://github.com/authzed/spicedb/issues/358 advisory pihak ketiga
• https://github.com/authzed/spicedb/releases/tag/v1.4.0 release notes · advisory pihak ketiga
• https://github.com/authzed/spicedb/security/advisories/GHSA-7p8f-8hjm-wm92 advisory pihak ketiga