Vulnerability · Published Aug 15, 2023 · Assigned by sap
CVE-2023-39438Missing Authorization check allows certain operations on CLA Assistant data
High 8.1
In plain English
A high-severity missing authorization in CLA Assistant from SAP_SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).
Official description
A missing authorization check allows an arbitrary authenticated user to perform certain operations through the API of CLA-assistant by executing specific additional steps. This allows an arbitrary authenticated user to read CLA information including information of the persons who signed them as well as custom fields the CLA requester had configured. In addition, an arbitrary authenticated user can update or delete the CLA-configuration for repositories or organizations using CLA-assistant. The stored access tokens for GitHub are not affected, as these are redacted from the API-responses.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SAP_SE | CLA Assistant | <= 2.13.0 |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N