medium4.3
CVE-2022-32169
Bytebase does not restrict low privilege user to access admin issues
Impact
The `Bytebase` application does not restrict low privilege user to access `admin issues` for which an unauthorized user can view the `OPEN` and `CLOSED` issues by `Admin` and the affected endpoint is `/issue`.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/bytebase/bytebase | >= 0.1.0, <= 1.0.4 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Bytebase | Bytebase | from 0.1.0 through 1.0.4 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/bytebase/bytebase/blob/1.0.4/frontend/src/store/modules/issue.ts#L108-L187
- https://www.mend.io/vulnerability-database/CVE-2022-32169
- https://github.com/advisories/GHSA-5rc4-v5mj-g8c4
- https://nvd.nist.gov/vuln/detail/CVE-2022-32169
- https://github.com/bytebase/bytebase/blob/1.0.4/frontend/src/store/modules/issue.ts#L108-#L187