QID 983120

QID 983120: Java (maven) Security Update for com.yahoo.elide:elide-core (GHSA-2mxr-89gf-rc4v)

Security update has been released for com.yahoo.elide:elide-core to fix the vulnerability.

Note: The preceding description block is extracted directly from the security advisory. Using automation, we have attempted to clean and format it as much as possible without introducing additional issues.

It is possible for an adversary to "guess and check" the value of a model field they do not have access to assuming they can read at least one other field in the model. The adversary can construct filter expressions for an inaccessible field to filter a collection. The presence or absence of models in the returned collection can be used to reconstruct the value of the inaccessible field.

For example, a User model has two fields: _name_ and _role_. The adversary has read permissions to see the _name_ field of the User collection but not the _role_. By constructing a filter like the one below, the adversary can determine which users have admin role by presence or absence in the returned collection:
`filter=role=="Admin"`

CVSS V3 rated as High - 6.5 severity.

CVSS V2 rated as Medium - 4 severity.

Solution

Resolved in Elide 4.5.14 and greater.Workaround:
The adversary can only access the fields if a model includes fields with different read permission levels (some less secure and some more secure). Model security can be adjusted by restricting read permissions on existing models.

Vendor References

GHSA-2mxr-89gf-rc4v - github.com/advisories/GHSA-2mxr-89gf-rc4v

CVEs related to QID 983120

CVE-2020-5289 |

Software Advisories

Advisory ID	Software	Component	Link
GHSA-2mxr-89gf-rc4v	com.yahoo.elide:elide-core		github.com/advisories/GHSA-2mxr-89gf-rc4v

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].