icon

We found results for “

CVE-2022-21646

Good to know:

icon

Date: January 11, 2022

SpiceDB is a database system for managing security-critical application permissions. Any user making use of a wildcard relationship under the right hand branch of an "exclusion" or within an "intersection" operation will see "Lookup"/"LookupResources" return a resource as "accessible" if it is not accessible by virtue of the inclusion of the wildcard in the intersection or the right side of the exclusion. In "v1.3.0", the wildcard is ignored entirely in lookup's dispatch, resulting in the "banned" wildcard being ignored in the exclusion. Version 1.4.0 contains a patch for this issue. As a workaround, don't make use of wildcards on the right side of intersections or within exclusions.

Language: Go

Severity Score

Severity Score

Weakness Type (CWE)

Improper Input Validation

CWE-20

Improper Neutralization of Wildcards or Matching Symbols

CWE-155

Top Fix

icon

Upgrade Version

Upgrade to version github.com/authzed/spicedb - v1.4.0

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): LOW
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): HIGH
Integrity (I): HIGH
Availability (A): NONE

CVSS v2

Base Score:
Access Vector (AV): NETWORK
Access Complexity (AC): LOW
Authentication (AU): SINGLE
Confidentiality (C): PARTIAL
Integrity (I): PARTIAL
Availability (A): NONE
Additional information:

Do you need more information?

Contact Us