Insufficient Access Control in Backstage TechDocs with AWS S3 and GCS Storage
CVE-2024-45816

6.5MEDIUM

Key Information:

Vendor

Backstage

Status
Backstage
Vendor
CVE Published:
17 September 2024

What is CVE-2024-45816?

The Backstage TechDocs plugin, when using AWS S3 or Google Cloud Storage (GCS) as a storage provider, possesses an inadequate access control mechanism that may allow unauthorized users to access sensitive content stored in the entire bucket. This vulnerability could result in unintended data exposure and the potential bypassing of permission checks within the system. Users are strongly encouraged to upgrade to version 1.10.13 of the @backstage/plugin-techdocs-backend package to mitigate these risks, as there are no known workarounds available for this issue.

References

https://github.com/backstage/backstage/security/advisorie...

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

.