~ / search / GHSA-95x7-mh78-7w2r

GHSA-95x7-mh78-7w2r

OpenFGA subject to Information Disclosure via streamed-list-objects endpoint

Source: GitHub Advisory Database (reviewed) Moderate CVE-2022-39340

Packages

EcosystemPackageAffectedFixed in
Go github.com/openfga/openfga < 0.2.4 0.2.4

Details

As written in the advisory (Markdown source, shown as plain text).

### Overview During our internal security assessment, it was discovered that `streamed-list-objects` endpoint was not validating the authorization header resulting in the disclosure of objects in the store. ### Am I Affected? You are affected by this vulnerability if you are using `openfga/openfga` version `v0.2.3` or prior and you are exposing the OpenFGA service to the internet. ### How to fix that? Upgrade to version `v0.2.4`. ### Backward Compatibility This update is backward compatible.

References

External links from the advisory. They lead to third-party sites.