6.3

CVE-2024-58363

SurrealDB before 1.5.4 Authentication Bypass via Database Switch

SurrealDB before 1.5.4 fails to properly validate authentication when a scope user switches databases using the USE clause or use method. Attackers with an authenticated session can impersonate an unrelated user in a different database if a user record with an identical identifier exists, allowing unauthorized actions if permissions rely solely on the $auth parameter.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Surrealdb ≫ Surrealdb Version < 1.5.4
Surrealdb ≫ Surrealdb Version 2.0.0 Update alpha1
Surrealdb ≫ Surrealdb Version 2.0.0 Update alpha2
Surrealdb ≫ Surrealdb Version 2.0.0 Update alpha3
Surrealdb ≫ Surrealdb Version 2.0.0 Update alpha4
Surrealdb ≫ Surrealdb Version 2.0.0 Update alpha5
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.19% 0.093
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
disclosure@vulncheck.com 5.3 0 0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
disclosure@vulncheck.com 6.3 2.8 3.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CWE-287 Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

https://github.com/surrealdb/surrealdb/security/advisories/GHSA-gh9f-6xm2-c4j2
Vendor Advisory
https://www.vulncheck.com/advisories/surrealdb-before-authentication-bypass-via-database-switch
Third Party Advisory