Improper Access Control in StackStorm by StackStorm
CVE-2022-44009

7.5HIGH

Key Information:

Vendor

Stackstorm

Status
Stackstorm
Vendor
CVE Published:
6 December 2022

What is CVE-2022-44009?

An improper access control vulnerability exists in StackStorm version 3.7.0, specifically within the Key-Value Role-Based Access Control (RBAC) system. This issue allows unauthorized users to bypass permission checks in Jinja filters, thereby accessing Key/Value pairs that belong to other users. This flaw raises significant concerns as it could potentially lead to the unintentional exposure of sensitive information, highlighting the importance of robust access control measures in software systems.

References

https://stackstorm.com/2022/12/v3-8-0-released/

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.