Vulnerability · Published Mar 30, 2020 · Assigned by GitHub_M

CVE-2020-5289Read permissions not enforced for client provided filter expressions in Elide http client

Medium 6.8

In plain English

A medium-severity security flaw in elide from yahoo. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 70% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.8Medium

Exploit odds (30 days)1.3%top 30.5% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

In Elide before 4.5.14, it is possible for an adversary to "guess and check" the value of a model field they do not have access to assuming they can read at least one other field in the model. The adversary can construct filter expressions for an inaccessible field to filter a collection. The presence or absence of models in the returned collection can be used to reconstruct the value of the inaccessible field. Resolved in Elide 4.5.14 and greater.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Maven	com.yahoo.elide:elide-core	4.5.14	GHSA-2mxr-89gf-rc4v

Affected products (as reported)

Vendor	Product	Versions
yahoo	elide	< 4.5.14

Weakness: CWE-285 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N

References

https://github.com/yahoo/elide/security/advisories/GHSA-2mxr-89gf-rc4v x_refsource_CONFIRM
https://github.com/yahoo/elide/pull/1236 x_refsource_MISC
https://github.com/yahoo/elide/pull/1236/commits/a985f0f9c448aabe70bc904337096399de4576dc x_refsource_MISC