CVE-2024-27916highCWE-285

CVE-2024-27916: fallo de gravedad alta en stacklok minder

`GetRepositoryByName`, `DeleteRepositoryByName` and `GetArtifactByName` allow access of arbitrary repositories in Minder by any authenticated user

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear minder+ Monitorear github.com/stacklok/minder

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7.1epss 0.7%
Minder is a software supply chain security platform. Prior to version 0.0.33, a Minder user can use the endpoints `GetRepositoryByName`, `DeleteRepositoryByName`, and `GetArtifactByName` to access any repository in the database, irrespective of who owns the repo and any permissions present. The database query checks by repo owner, repo name and provider name (which is always `github`). These query values are not distinct for the particular user - as long as the user has valid credentials and a provider, they can set the repo owner/name to any value they want and the server will return information on this repo. Version 0.0.33 contains a patch for this issue.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
Productos afectados
stacklok · minder
CVEs relacionadas — stacklok minder

En el mismo producto, de las más peligrosas a las menos.

CVE-2024-31455MEDIUMMinder GetRepositoryByName data leakEPSS 0.8%CVE-2024-34084HIGHMinder's Github Webhook Handler vulnerable to denial of service from un-validated requestsEPSS 0.6%CVE-2024-27093MEDIUMMinder trusts client-provided mapping from repo name to upstream IDEPSS 0.6%CVE-2024-35238MEDIUMDenial of service of Minder Server from maliciously crafted GitHub attestationsEPSS 0.5%CVE-2024-35185MEDIUMDenial of service of Minder Server with attacker-controlled REST endpointEPSS 0.5%CVE-2024-37904MEDIUMDenial of service from maliciously configured Git repository in MinderEPSS 0.5%