CVE Vulnerability

CVE-2020-5289

In Elide before 4.5.14, it is possible for an adversary to "guess and check" the value of a model field they do not have access to assuming they can read at least one other field in the model. The adversary can construct filter expressions for an inaccessible field to filter a collection. The presence or absence of models in the returned collection can be used to reconstruct the value of the inaccessible field. Resolved in Elide 4.5.14 and greater.

4 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 8 / Impact : 2.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

Scope

6.5 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/yahoo/elide/security/advisories/GHSA-2mxr-89gf-rc4v Third Party Advisory
https://github.com/yahoo/elide/pull/1236 Patch Third Party Advisory
https://github.com/yahoo/elide/pull/1236/commits/a985f0f9c448aabe70bc904337096399de4576dc Patch
Configurations

Configuration 1

cpe:2.3:a:elide:elide:*:*:*:*:*:*:*:*
Information

Published : 2020-03-30 10:15

Updated : 2020-04-01 07:34

NVD link : CVE-2020-5289

Mitre link : CVE-2020-5289

Products Affected
No products.
CWE
CWE-552