OpenFGA Authorization Bypass
CVE-2022-39352

4.8MEDIUM

Key Information:

Vendor

Openfga

Status
Openfga
Vendor
CVE Published:
8 November 2022

What is CVE-2022-39352?

OpenFGA is a high-performance authorization/permission engine inspired by Google Zanzibar. Versions prior to 0.2.5 are vulnerable to authorization bypass under certain conditions. You are affected by this vulnerability if you added a tuple with a wildcard (*) assigned to a tupleset relation (the right hand side of a ā€˜fromā€™ statement). This issue has been patched in version v0.2.5. This update is not backward compatible with any authorization model that uses wildcard on a tupleset relation.

Affected Version(s)

openfga < 0.2.5

References

https://github.com/openfga/openfga/security/advisories/GH...

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.