Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: GSA_kwCzR0hTQS1odnA0LXZydjItOHdycc4AA5Kn

Kinto Attachment's attachments can be replaced on read-only records

Impact

The attachment file of an existing record can be replaced if the user has "read" permission on one of the parent (collection or bucket).

And if the "read" permission is given to "system.Everyone" on one of the parent, then the attachment can be replaced on a record using an anonymous request.

Note that if the parent has no explicit read permission, then the records attachments are safe.

Patches

Workarounds

None if the read permission has to remain granted.

Updating to 6.4.0 or applying the patch individually (if updating is not feasible) is strongly recommended.

References

Permalink: https://github.com/advisories/GHSA-hvp4-vrv2-8wrq
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1odnA0LXZydjItOHdycc4AA5Kn
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: 22 days ago
Updated: 22 days ago


CVSS Score: 8.6
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

Identifiers: GHSA-hvp4-vrv2-8wrq, CVE-2024-1314
References:

Affected Packages

pypi:kinto-attachment
Versions: <= 6.3.2
Fixed in: 6.4.0