CVE-2022-21707

Katalog CVE

CVSS 8.1 · High EPSS 0,82%

Kerentanan Incorrect Authorization pada wasmcloud host runtime. Skor CVSS 3.1 8.1 (High) menurut NVD.

Deskripsi (NVD)

wasmCloud Host Runtime is a server process that securely hosts and provides dispatch for web assembly (WASM) actors and capability providers. In versions prior to 0.52.2 actors can bypass capability authorization. Actors are normally required to declare their capabilities for inbound invocations, but with this vulnerability actor capability claims are not verified upon receiving invocations. This compromises the security model for actors as they can receive unauthorized invocations from linked capability providers. The problem has been patched in versions `0.52.2` and greater. There is no workaround and users are advised to upgrade to an unaffected version as soon as possible.

Rincian

Terbit di NVD

21 Januari 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.1 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-863: Incorrect Authorization
CWE-862: Missing Authorization

EPSS (30 hari)

0,82% peluang dieksploitasi; lebih tinggi dari 56,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/wasmCloud/wasmcloud-otp/commit/fd07262074b98b06106a31fd1957dc2319d438a5 patch · advisory pihak ketiga
• https://github.com/wasmCloud/wasmcloud-otp/security/advisories/GHSA-2cmx-rr54-88g5 advisory pihak ketiga