8.1

CVE-2023-38510

Tolgee Lacks Permission Check for API Key for some endpoints

Tolgee is an open-source localization platform. Starting in version 3.14.0 and prior to version 3.23.1, when a request is made using an API key, the backend fails to verify the permission scopes associated with the key, effectively bypassing permission checks entirely for some endpoints. It's important to note that this vulnerability only affects projects that have inadvertently exposed their API keys on the internet. Projects that have kept their API keys secure are not impacted. This issue is fixed in version 3.23.1.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Tolgee ≫ Tolgee Version >= 3.14.0 < 3.23.1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.49% 0.379
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 8.1 2.8 5.2
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
security-advisories@github.com 8.1 2.8 5.2
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CWE-862 Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

https://github.com/tolgee/tolgee-platform/commit/4776cba67e7bb8c1b0259376e3e5fa3bb46e45c7
Patch
https://github.com/tolgee/tolgee-platform/pull/1818
Patch
https://github.com/tolgee/tolgee-platform/releases/tag/v3.23.1
Release Notes
https://github.com/tolgee/tolgee-platform/security/advisories/GHSA-4f9j-4vh4-p85v
Vendor Advisory