Spicedb
CVE-2023-35930
MEDIUM
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionNVD
SpiceDB is an open source, Google Zanzibar-inspired, database system for creating and managing security-critical application permissions. Any user making a negative authorization decision based on the results of a LookupResources request with 1.22.0 is affected. For example, using LookupResources to find a list of resources to allow access to be okay: some subjects that should have access to a resource may not. But if using LookupResources to find a list of banned resources instead, then some users that shouldn't have access may. Generally, LookupResources is not and should not be to gate access in this way - that's what the Check API is for. Additionally, version 1.22.0 has included a warning about this bug since its initial release. Users are advised to upgrade to version 1.22.2. Users unable to upgrade should avoid using LookupResources for negative authorization decisions.
AnalysisAI
SpiceDB is an open source, Google Zanzibar-inspired, database system for creating and managing security-critical application permissions. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Technical ContextAI
This vulnerability is classified under CWE-913. SpiceDB is an open source, Google Zanzibar-inspired, database system for creating and managing security-critical application permissions. Any user making a negative authorization decision based on the results of a LookupResources request with 1.22.0 is affected. For example, using LookupResources to find a list of resources to allow access to be okay: some subjects that should have access to a resource may not. But if using LookupResources to find a list of banned resources instead, then some users that shouldn't have access may. Generally, LookupResources is not and should not be to gate access in this way - that's what the Check API is for. Additionally, version 1.22.0 has included a warning about this bug since its initial release. Users are advised to upgrade to version 1.22.2. Users unable to upgrade should avoid using LookupResources for negative authorization decisions. Affected products include: Authzed Spicedb. Version information: version 1.22.0.
RemediationAI
A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
Spicedb is an Open Source, Google Zanzibar-inspired permissions database to enable fine-grained authorization for custom
SpiceDB is an open source, Google Zanzibar-inspired database for creating and managing security-critical application per
SpiceDB is an open source, Google Zanzibar-inspired, database system for creating and managing security-critical applica
SpiceDB is an open source, Google Zanzibar-inspired database for creating and managing security-critical application per
spicedb is an Open Source, Google Zanzibar-inspired permissions database to enable fine-grained authorization for custom
SpiceDB is a graph database purpose-built for storing and evaluating access control data. Rated medium severity (CVSS 4.
A remote code execution vulnerability in SpiceDB (CVSS 3.7). Remediation should follow standard vulnerability management
SpiceDB is an open source database for scalably storing and querying fine-grained authorization data. Rated low severity
SpiceDB is an open source database system for creating and managing security-critical application permissions. Rated low
SpiceDB is an open source database system for creating and managing security-critical application permissions. Rated low
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today