CVE-2017-15914 Borg Improper Access Control vulnerability
Remote attackers can bypass repository restrictions in Borg servers to access or modify unauthorized backup data.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-15914?
CVE-2017-15914 is a high-severity missing authorization vulnerability in n/a, published on 8 Feb 2018. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Incorrect implementation of access controls allows remote users to override repository restrictions in Borg servers 1.1.x before 1.1.3.
Which versions are affected by CVE-2017-15914?
3 open source packages ship an affected version, including borgbackup. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
borgbackup PyPI | From 1.1.0b1 | 1.1.3 |
borgbackup PyPI | From 1.1.0b1 | 1.1.3 |
borgbackup PyPI | From 1.1.0b1 | 1.1.3 |
Products include Borgbackup Borg.
How do I fix CVE-2017-15914?
Upgrade borgbackup to 1.1.3 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2017-15914 being exploited?
There is no known exploitation of CVE-2017-15914 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as DEBIAN-CVE-2017-15914, GHSA-8q8v-28rm-qw4w, PYSEC-2018-105.