SurrealDB 在以范围用户身份更改数据库时容易受到身份验证不当的影响

CVE编号

N/A

利用情况

暂无

补丁情况

N/A

披露时间

2024-07-11

漏洞描述

Authentication would not be properly validated when an already authenticated scope user would use the use method or USE clause to switch working databases in a session. If there was a user record in the new database with identical record identifier as the original record that the user authenticated with in the original database, this could result in the user being able to perform actions under the identity of the unrelated user in the new database. This issue does not affect system users at any level.

解决建议

建议您更新当前系统或软件至最新版，完成漏洞的修复。

参考链接
https://github.com/advisories/GHSA-gh9f-6xm2-c4j2

CVSS3评分 N/A

• 攻击路径 N/A
• 攻击复杂度 N/A
• 权限要求 N/A
• 影响范围 N/A
• 用户交互 N/A
• 可用性 N/A
• 保密性 N/A
• 完整性 N/A

N/A

CWE-ID	漏洞类型
CWE-287	认证机制不恰当

Exp相关链接

- avd.aliyun.com