Missing Authorization check allows certain operations on CLA Assistant data
CVE-2023-39438

8.1HIGH

Key Information:

Vendor

SAP
Status
Cla Assistant
Vendor
CVE Published:
15 August 2023

What is CVE-2023-39438?

A missing authorization check in the CLA-assistant API permits any authenticated user to conduct unauthorized operations. This includes the ability to read sensitive CLA information and configurations tied to repositories or organizations. Specifically, users can access details about CLA signers and custom fields configured by CLA requesters. Furthermore, they can update or even delete existing CLA configurations. Fortunately, stored access tokens for GitHub remain secure as they are redacted in the API responses.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

CLA Assistant <= 2.13.0

References

https://github.com/cla-assistant/cla-assistant/security/a...

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.