CVE-2020-5289 Read permissions not enforced for client provided filter expressions in Elide http client
Attackers can infer values of inaccessible model fields by observing filter results, leading to unauthorized data disclosure in Elide applications.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2020-5289?
CVE-2020-5289 is a medium-severity missing authorization vulnerability in yahoo elide, published on 30 Mar 2020. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
In Elide before 4.5.14, it is possible for an adversary to "guess and check" the value of a model field they do not have access to assuming they can read at least one other field in the model. The adversary can construct filter expressions for an inaccessible field to filter a collection. The presence or absence of models in the returned collection can be used to reconstruct the value of the inaccessible field. Resolved in Elide 4.5.14 and greater.
Which versions are affected by CVE-2020-5289?
2 open source packages ship an affected version, including com.yahoo.elide:elide-core. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
com.yahoo.elide:elide-core Maven | All versions | 4.5.14 |
com.yahoo.elide:elide-core Maven | All versions | 4.5.14 |
Products include Elide Elide.
How do I fix CVE-2020-5289?
Upgrade com.yahoo.elide:elide-core to 4.5.14 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2020-5289 being exploited?
There is no known exploitation of CVE-2020-5289 in the wild and no public exploit code.
Other vulnerabilities in yahoo elide
Sources
Also known as GHSA-2mxr-89gf-rc4v.