marius/Open_Ultra_SAST
1
0
Fork 0
mirror of https://github.com/norandom/OpenUltraSAST.git synced 2026-10-16 11:49:28 +00:00
Code Issues Packages Projects Releases Wiki Activity

data: access-control batch verified, awaiting spot-check: 57 of 78 cloned (6 GB disk guard), 148 catalog sites, 69 pass all three checks in 27 changes

Browse Source 
Java 63 of 69 sites. verify: 148 records, 701 deepseek-flash calls, no provider errors. The 21
uncloned sources are in sources_access_control_dropped.json for a later clone pass.

Co-Authored-By: Claude Fable 5.1 <[email protected]>
This commit is contained in:
Marius Ciepluch
2026-10-13 22:07:39 +02:00
co-authored by Claude Fable 5.1
parent 6a9e4093fe
commit 60cbefec9b
5 changed files with 5084 additions and 294 deletions
Download Patch File Download Diff File Expand all files Collapse all files
benchmarks/valid/train/CANDIDATES_access_control.md
+324
View File
@@ -0,0 +1,324 @@
# Training-set candidates for the maintainer's spot-check
Generated 2026-10-13 by `benchmarks/valid/train/sourcing.py candidates`. Every location below passed all three
model checks (vulnerable before the fix, fix addresses it, reachable from an in-repo entry point) and waits for a
human accept or reject. Nothing here is a positive until accepted. Accept or reject a location with
.venv/bin/python -m benchmarks.valid.verify spot-check benchmarks/valid/train/verification.json <id> accept|reject --reviewer <you> --date YYYY-MM-DD
Sites passing: 69 in 27 repositories, 27 positive changes (fix commits); languages: java 63, javascript 2, php 2, python 1, typescript 1
The verifier's entry point is the model's claim, not a checked fact; it is the reason the site passed the reachability check.
## apache/seatunnel
- advisory: GHSA-9x53-gr7p-4qf5 (access_control, CWE-306), origin `?`, ecosystem ?, licence ?
- fix `53325aa3e76e3939f41a4bf3eaaf3ee56f13f311`, parent (fix^1) `8a9db476bdc37d5e4079491bdb7092b892a17a7b`
- advisory title: Apache SeaTunnel: Unauthenticated insecure access
| id | path::function (pre-fix lines) | language | entry point (verifier) | confidence |
|---|---|---|---|---|
| `apache-seatunnel-aff20b2911a11f57` | `seatunnel-engine/seatunnel-engine-server/src/main/java/org/apache/seatunnel/engine/server/JettyService.java::JettyService` (88-100) | java | /hazelcast/rest/maps/submit-job (SubmitJobServlet) via JettyService.createJettyServer | 0.75 |
## friendsofflarum/byobu
- advisory: GHSA-6gjm-6wj6-4px5 (access_control, CWE-863), origin `?`, ecosystem ?, licence ?
- fix `23dcf93a30f948d30c678a96681f7fdefeba5171`, parent (fix^1) `2e99cdb7e356a259ea90aa7f84a71fc0f050e006`
- advisory title: Byobu user preference to prevent private discussions being started are not respected
| id | path::function (pre-fix lines) | language | entry point (verifier) | confidence |
|---|---|---|---|---|
| `friendsofflarum-byobu-7173b8a509cf3e27` | `js/src/forum/extend/User.js::extend` (19-62) | javascript | UserControls 'userControls' extension rendering the private-discussion button on a user's profile page; source is the target user's blocksPd/cannotBeDirectMessaged attributes | 0.75 |
| `friendsofflarum-byobu-f34c4fa78b9178db` | `js/src/forum/pages/PrivateDiscussionsUserPage.js::actionItems` (55-66) | javascript | PrivateDiscussionsUserPage.actionItems rendered via content() on the user private discussions page route (m.route.param('username')) | 0.75 |
## jenkinsci/analysis-core-plugin
- advisory: GHSA-vvfj-p4jf-j8rm (access_control, CWE-862), origin `?`, ecosystem ?, licence ?
- fix `3d7a0c7907d831c58541508b893dcea2039809c5`, parent (fix^1) `892ab94f85a49d8c04b302c9bf48b112efe97536`
- advisory title: Missing permission check in Jenkins Static Analysis Utilities Plugin
| id | path::function (pre-fix lines) | language | entry point (verifier) | confidence |
|---|---|---|---|---|
| `jenkinsci-analysis-core-plugin-e02e86e3c18ec1d6` | `src/main/java/hudson/plugins/analysis/graph/DefaultGraphConfigurationView.java::persistValue` (126-136) | java | DefaultGraphConfigurationView#doSave form handler (configureDefaults URL) via StaplerRequest | 0.85 |
## jenkinsci/azure-credentials-plugin
- advisory: GHSA-7j55-28qq-676g (access_control, CWE-862), origin `?`, ecosystem ?, licence ?
- fix `64da8176c83a41bb83d3ad759628c9bd275b42f5`, parent (fix^1) `887e0f9e898b2765d78e53c7b39017b8d6295dca`
- advisory title: Missing Authorization in Jenkins Azure Credentials Plugin
| id | path::function (pre-fix lines) | language | entry point (verifier) | confidence |
|---|---|---|---|---|
| `jenkinsci-azure-credentials-plugin-0dab78b4ed2c29bb` | `src/main/java/com/microsoft/jenkins/keyvault/SecretStringCredentials.java::doVerifyConfiguration` (46-64) | java | Jenkins Stapler HTTP endpoint /descriptorByName/com.microsoft.jenkins.keyvault.SecretStringCredentials/doVerifyConfiguration (doVerifyConfiguration in DescriptorImpl), invoked via web request with ser | 0.85 |
| `jenkinsci-azure-credentials-plugin-144d42edd4fea476` | `src/main/java/com/microsoft/jenkins/keyvault/BaseSecretCredentials.java::doFillServicePrincipalIdItems` (97-103) | java | Jenkins Stapler web endpoint doFillServicePrincipalIdItems on the Azure Credentials DescriptorImpl (form fill for servicePrincipalId), reachable by any user with Overall/Read permission | 0.85 |
| `jenkinsci-azure-credentials-plugin-81c51344b9d31af8` | `src/main/java/com/microsoft/azure/util/AzureCredentials.java::doVerifyConfiguration` (772-800) | java | Jenkins Stapler HTTP endpoint doVerifyConfiguration on AzureCredentials.DescriptorImpl, invoked via form validation request with query parameters (subscriptionId, clientId, clientSecret, etc.) | 0.85 |
| `jenkinsci-azure-credentials-plugin-a83f939fb055e6a0` | `src/main/java/com/microsoft/azure/util/AzureCredentials.java::doFillCertificateIdItems` (802-808) | java | Jenkins Stapler web method doFillCertificateIdItems on AzureCredentials.DescriptorImpl, invoked via the credentials configuration form (e.g. /descriptorByName/com.microsoft.azure.util.AzureCredentials | 0.85 |
| `jenkinsci-azure-credentials-plugin-af7645f7ae48e24c` | `src/main/java/com/microsoft/jenkins/keyvault/SecretCertificateCredentials.java::doVerifyConfiguration` (105-134) | java | Jenkins Stapler HTTP endpoint DescriptorImpl.doVerifyConfiguration (form validation endpoint) invoked via web request with @QueryParameter servicePrincipalId/secretIdentifier/password | 0.85 |
| `jenkinsci-azure-credentials-plugin-bd1228731e6d22aa` | `src/main/java/com/microsoft/azure/util/AzureImdsCredentials.java::validate` (55-94) | java | DescriptorImpl.doVerifyConfiguration (@POST, @QueryParameter subscriptionId/clientId/azureEnvironmentName) | 0.75 |
| `jenkinsci-azure-credentials-plugin-d3c1129ce0199756` | `src/main/java/com/microsoft/azure/util/AzureImdsCredentials.java::doVerifyConfiguration` (107-128) | java | Jenkins DescriptorImpl.doVerifyConfiguration (AzureImdsCredentials) exposed via Stapler HTTP endpoint /descriptorByName/.../doVerifyConfiguration with @QueryParameter subscriptionId, clientId, azureEn | 0.85 |
## jenkinsci/azure-keyvault-plugin
- advisory: GHSA-gf8w-6hcm-rh3j (access_control, CWE-862), origin `?`, ecosystem ?, licence ?
- fix `f09ed652cc572d8ba5d7c8c8f9972fd241883c21`, parent (fix^1) `36680c54a27685d6d35d75135daa6e386a107a1b`
- advisory title: Missing permission checks in Jenkins Azure Key Vault Plugin allow enumerating credentials IDs
| id | path::function (pre-fix lines) | language | entry point (verifier) | confidence |
|---|---|---|---|---|
| `jenkinsci-azure-keyvault-plugin-a9975f6d8b4f1568` | `src/main/java/org/jenkinsci/plugins/azurekeyvaultplugin/AzureKeyVaultBuildWrapper.java::SuppressWarnings` (290-295) | java | Jenkins Stapler HTTP endpoint doFillCredentialIDOverrideItems on AzureKeyVaultBuildWrapper.DescriptorImpl (form fill for credentialIDOverride field), reachable by any user with Overall/Read permission | 0.85 |
| `jenkinsci-azure-keyvault-plugin-abd182ce20617255` | `src/main/java/org/jenkinsci/plugins/azurekeyvaultplugin/AzureKeyVaultStep.java::SuppressWarnings` (218-223) | java | DescriptorImpl.doFillCredentialIDItems (Jenkins Stapler HTTP endpoint /job/.../descriptorByName/.../fillCredentialIDItems) | 0.75 |
## jenkinsci/blueocean-plugin
- advisory: GHSA-vc7g-4269-f7hw (access_control, CWE-862), origin `?`, ecosystem ?, licence ?
- fix `659a66aff0d0ad693eab9d2807985d591e102aab`, parent (fix^1) `966da5a824c0e78767ba8b6a40be2ebfd8d8919f`
- advisory title: Missing permission check in Blue Ocean Plugin
| id | path::function (pre-fix lines) | language | entry point (verifier) | confidence |
|---|---|---|---|---|
| `jenkinsci-blueocean-plugin-5aa4f2eb0a53ebfe` | `blueocean-github-pipeline/src/main/java/io/jenkins/blueocean/blueocean_github_pipeline/GithubServerContainer.java::create` (56-145) | java | GithubServerContainer.create(@JsonBody JSONObject request) invoked via Blue Ocean HTTP endpoint for creating GitHub server; attacker-controlled source is the 'apiUrl' field in the JSON request body, w | 0.85 |
| `jenkinsci-blueocean-plugin-e4ad2dadd845ec00` | `blueocean-bitbucket-pipeline/src/main/java/io/jenkins/blueocean/blueocean_bitbucket_pipeline/server/BitbucketServerEndpointContainer.java::create` (44-97) | java | Blue Ocean REST endpoint POST /blueocean/rest/.../servers (ScmServerEndpointContainer.create) accepting JSONObject request with attacker-controlled API_URL | 0.75 |
## jenkinsci/compuware-scm-downloader-plugin
- advisory: GHSA-75fc-fv3p-xh82 (access_control, CWE-862), origin `?`, ecosystem ?, licence ?
- fix `bf00665b13641351a9f67027bbe34609cc4f65e2`, parent (fix^1) `115f057078baad506e2b34b74f4f0600f81990b3`
- advisory title: Jenkins Compuware Source Code Download is missing authorization
| id | path::function (pre-fix lines) | language | entry point (verifier) | confidence |
|---|---|---|---|---|
| `jenkinsci-compuware-scm-downloader-plugin-29636a1534a39217` | `src/main/java/com/compuware/jenkins/scm/PdsConfiguration.java::doFillConnectionIdItems` (254-276) | java | Jenkins Stapler HTTP endpoint doFillConnectionIdItems (e.g. /job/<name>/descriptorByName/.../fillConnectionIdItems) invoked via config.jelly connectionId field; attacker-controlled source is the HTTP | 0.85 |
| `jenkinsci-compuware-scm-downloader-plugin-316557e9fdf67223` | `src/main/java/com/compuware/jenkins/scm/IspwContainerConfiguration.java::doFillConnectionIdItems` (312-334) | java | Jenkins Stapler HTTP endpoint doFillConnectionIdItems (e.g. /job/<name>/descriptorByName/.../fillConnectionIdItems) invoked via config.jelly connectionId field; attacker-controlled source is the HTTP | 0.85 |
| `jenkinsci-compuware-scm-downloader-plugin-4b64810cb01a07f5` | `src/main/java/com/compuware/jenkins/scm/AbstractConfiguration.java::doFillCredentialsIdItems` (107-131) | java | Jenkins Stapler HTTP endpoint doFillCredentialsIdItems (e.g. /job/<name>/descriptorByName/.../fillCredentialsIdItems) invoked with Overall/Read permission; attacker-controlled source is the credential | 0.85 |
| `jenkinsci-compuware-scm-downloader-plugin-936a096a4a941ee5` | `src/main/java/com/compuware/jenkins/scm/EndevorConfiguration.java::doFillConnectionIdItems` (255-277) | java | Jenkins Stapler HTTP endpoint doFillConnectionIdItems (e.g. /job/<name>/descriptorByName/.../fillConnectionIdItems) invoked via config.jelly connectionId field; attacker-controlled source is the HTTP | 0.85 |
| `jenkinsci-compuware-scm-downloader-plugin-c416a32628e63296` | `src/main/java/com/compuware/jenkins/scm/IspwConfiguration.java::doFillConnectionIdItems` (416-438) | java | Jenkins Stapler HTTP endpoint doFillConnectionIdItems (e.g. /job/<name>/descriptorByName/.../fillConnectionIdItems) invoked via @QueryParameter connectionId | 0.85 |
## jenkinsci/compuware-topaz-for-total-test-plugin
- advisory: GHSA-x5gv-5rqv-654m (access_control, CWE-862), origin `?`, ecosystem ?, licence ?
- fix `0ba4274d545eac39e3db48b5dfb4512db3242946`, parent (fix^1) `5fca6eb21599f8f27323dfa17a6e44f8176ca551`
- advisory title: Jenkins Compuware Topaz for Total Test Plugin allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins
| id | path::function (pre-fix lines) | language | entry point (verifier) | confidence |
|---|---|---|---|---|
| `jenkinsci-compuware-topaz-for-total-test-plugin-0fcc9e440100be20` | `src/main/java/com/compuware/jenkins/totaltest/TotalTestBuilder.java::doFillCredentialsIdItems` (857-889) | java | Jenkins Stapler HTTP endpoint doFillCredentialsIdItems (descriptor form fill for credentialsId), reachable via Overall/Read authenticated user; source is the credentialsId query parameter and the cred | 0.85 |
| `jenkinsci-compuware-topaz-for-total-test-plugin-31007615cf224711` | `src/main/java/com/compuware/jenkins/totaltest/TotalTestCTBuilder.java::doFillConnectionIdItems` (1534-1556) | java | Jenkins Stapler HTTP endpoint doFillConnectionIdItems (e.g. /job/<name>/descriptorByName/.../fillConnectionIdItems) invoked with Overall/Read permission; @QueryParameter connectionId is attacker-contr | 0.85 |
| `jenkinsci-compuware-topaz-for-total-test-plugin-3b2dc3167c986714` | `src/main/java/com/compuware/jenkins/totaltest/TotalTestBuilder.java::doFillConnectionIdItems` (798-820) | java | Jenkins Stapler HTTP endpoint doFillConnectionIdItems (e.g. /job/<name>/descriptorByName/.../fillConnectionIdItems) invoked via @QueryParameter connectionId | 0.85 |
| `jenkinsci-compuware-topaz-for-total-test-plugin-8659f27b971d364f` | `src/main/java/com/compuware/jenkins/totaltest/TotalTestCTBuilder.java::doFillCredentialsIdItems` (1644-1670) | java | Jenkins Stapler HTTP endpoint doFillCredentialsIdItems on TotalTestCTBuilder (e.g. /job/<name>/descriptorByName/.../fillCredentialsIdItems), invoked via @QueryParameter credentialsId with Overall/Read | 0.85 |
| `jenkinsci-compuware-topaz-for-total-test-plugin-b0ca3df515237e75` | `src/main/java/com/compuware/jenkins/totaltest/TotalTestCTBuilder.java::doFillServerUrlItems` (1681-1773) | java | Jenkins Stapler HTTP endpoint doFillServerUrlItems / doFillServerCredentialsIdItems (form fill methods invoked via Jenkins UI/HTTP request with Overall/Read permission) | 0.85 |
| `jenkinsci-compuware-topaz-for-total-test-plugin-e724ca5f96b58ee5` | `src/main/java/com/compuware/jenkins/totaltest/TotalTestCTBuilder.java::doFillServerCredentialsIdItems` (1740-1766) | java | Jenkins Stapler HTTP endpoint doFillServerCredentialsIdItems (descriptor form fill method) reachable via the build step configuration UI; attacker-controlled source is the @QueryParameter serverCreden | 0.85 |
## jenkinsci/conjur-credentials-plugin
- advisory: GHSA-372f-jc47-7gr5 (access_control, CWE-862), origin `?`, ecosystem ?, licence ?
- fix `eda06cde26cdf2d40ae4e2f4d2709e8174489068`, parent (fix^1) `811b0672d5a88d2145823f7355619ddd5f328e17`
- advisory title: Missing permission check in Jenkins Conjur Secrets Plugin allows enumerating credentials IDs
| id | path::function (pre-fix lines) | language | entry point (verifier) | confidence |
|---|---|---|---|---|
| `jenkinsci-conjur-credentials-plugin-11205c0022207637` | `src/main/java/org/conjur/jenkins/conjursecrets/ConjurSecretCredentialsDescriptor.java::doFillCredentialIDItems` (22-27) | java | Jenkins Stapler HTTP endpoint doFillCredentialIDItems (form fill for credential ID field), invoked via web request with uri query parameter | 0.75 |
| `jenkinsci-conjur-credentials-plugin-25bfc860016819fb` | `src/main/java/org/conjur/jenkins/conjursecrets/ConjurSecretUsernameSSHKeyCredentialsImpl.java::doFillCredentialIDItems` (98-104) | java | Jenkins Stapler HTTP endpoint doFillCredentialIDItems on ConjurSecretUsernameSSHKeyCredentialsImpl.DescriptorImpl, invoked via the credentials form fill (e.g. credentialID field) with @QueryParameter | 0.85 |
| `jenkinsci-conjur-credentials-plugin-f42fa606284883ea` | `src/main/java/org/conjur/jenkins/conjursecrets/ConjurSecretUsernameCredentialsImpl.java::doFillCredentialIDItems` (96-103) | java | Jenkins Stapler HTTP endpoint doFillCredentialIDItems on ConjurSecretUsernameCredentialsImpl.DescriptorImpl, invoked via the credentials form fill (e.g. /descriptorByName/.../fillCredentialIDItems) wi | 0.85 |
## jenkinsci/crx-content-package-deployer-plugin
- advisory: GHSA-4cmq-88f8-53r5 (access_control, CWE-285), origin `?`, ecosystem ?, licence ?
- fix `06cd0e7e1b3f2fb87b3fa332ee1da710ca94b8e1`, parent (fix^1) `1313c422170a064dab0f9359324ff27e30a9f4a5`
- advisory title: Jenkins CRX Content Package Deployer Plugin subject to credentials enumeration via Missing Authorization
| id | path::function (pre-fix lines) | language | entry point (verifier) | confidence |
|---|---|---|---|---|
| `jenkinsci-crx-content-package-deployer-plugin-79286d969348bd3c` | `src/main/java/org/jenkinsci/plugins/graniteclient/GraniteAHCFactory.java::doFillCredentialsIdItems` (149-153) | java | Jenkins Stapler HTTP endpoint /descriptor/.../fillCredentialsIdItems (doFillCredentialsIdItems) invoked via form binding with @QueryParameter value | 0.85 |
## jenkinsci/database-plugin
- advisory: GHSA-hj36-v72x-cc6j (access_control, CWE-862), origin `?`, ecosystem ?, licence ?
- fix `7a438d96897af0034cb2e06db0819ca4595c24cb`, parent (fix^1) `a68258cf17ba8d5264010cc760770a62a3cc6c2d`
- advisory title: Missing permission checks in Jenkins Database Plugin
| id | path::function (pre-fix lines) | language | entry point (verifier) | confidence |
|---|---|---|---|---|
| `jenkinsci-database-plugin-6a8e141d0c9eaab2` | `src/main/java/org/jenkinsci/plugins/database/AbstractRemoteDatabaseDescriptor.java::doValidate` (24-42) | java | Stapler form validation endpoint doValidate on AbstractRemoteDatabaseDescriptor (e.g. /descriptorByName/.../validate) invoked via HTTP with @QueryParameter hostname, database, username, password, prop | 0.85 |
| `jenkinsci-database-plugin-d2e038dce743f4f4` | `src/main/java/org/jenkinsci/plugins/database/GenericDatabase.java::doCheckDriver` (85-110) | java | Jenkins form validation endpoint /descriptorByName/org.jenkinsci.plugins.database.GenericDatabase/doValidate (and doCheckDriver), invoked via HTTP with attacker-controlled driver, url, username, passw | 0.85 |
| `jenkinsci-database-plugin-fdb5a7fd01260ec1` | `src/main/java/org/jenkinsci/plugins/database/GenericDatabase.java::doValidate` (97-108) | java | Jenkins form validation endpoint doValidate (Descriptor.doValidate) invoked via HTTP POST with query parameters driver, url, username, password | 0.85 |
## jenkinsci/deployer-framework-plugin
- advisory: GHSA-rqqx-fvqx-539g (access_control, CWE-862), origin `?`, ecosystem ?, licence ?
- fix `7ba4a55bf3ec567ee5325ea7b24b4086ac1cb3ad`, parent (fix^1) `1d1888e8c0214fa42ee932b3eb26c06a6c7279f0`
- advisory title: Jenkins Deployer Framework Plugin allows attackers with Item/Read permission to read deployment logs
| id | path::function (pre-fix lines) | language | entry point (verifier) | confidence |
|---|---|---|---|---|
| `jenkinsci-deployer-framework-plugin-2929f3e176f304ad` | `src/main/java/com/cloudbees/plugins/deployer/sources/FixedDirectoryDeploySource.java::SuppressWarnings` (195-222) | java | Stapler HTTP endpoint doCheckDirectoryPath (FormValidation) on FixedDirectoryDeploySource.DescriptorImpl, invoked via @QueryParameter fromWorkspace/targetDescriptorId/value | 0.6 |
| `jenkinsci-deployer-framework-plugin-dd5ef66a767e04d5` | `src/main/java/com/cloudbees/plugins/deployer/DeployNowRunAction.java::doDeployText` (361-384) | java | Stapler HTTP endpoint doDeployText (DeployNowRunAction) reachable via URL /job/<job>/<build>/deploy-text or similar Stapler route; attacker-controlled source is the HTTP request handled by StaplerRequ | 0.85 |
## jenkinsci/ec2-plugin
- advisory: GHSA-6hmm-77r2-h6hr (access_control, CWE-862), origin `?`, ecosystem ?, licence ?
- fix `0cdbaf2d7da5c368209f427559c8608dec22a63b`, parent (fix^1) `2af0a6da84ef203c463981afbd81da0c0b1b5364`
- advisory title: Missing permission checks in Jenkins Amazon EC2 Plugin
| id | path::function (pre-fix lines) | language | entry point (verifier) | confidence |
|---|---|---|---|---|
| `jenkinsci-ec2-plugin-6058527110940076` | `src/main/java/hudson/plugins/ec2/EC2Cloud.java::doTestConnection` (934-959) | java | Jenkins Stapler form validation endpoint doTestConnection on EC2Cloud.DescriptorImpl, invoked via HTTP form validation request with attacker-controlled ec2endpoint, credentialsId, roleArn, roleSession | 0.85 |
| `jenkinsci-ec2-plugin-92278d8bf0b7f60a` | `src/main/java/hudson/plugins/ec2/EC2Cloud.java::doGenerateKey` (960-991) | java | Jenkins Stapler form validation endpoint /descriptorByName/hudson.plugins.ec2.EC2Cloud/doGenerateKey (and doTestConnection), invoked via HTTP with attacker-controlled ec2EndpointUrl, credentialsId, re | 0.85 |
## jenkinsci/electricflow-plugin
- advisory: GHSA-7rx6-4vwv-432g (access_control, CWE-862), origin `?`, ecosystem ?, licence ?
- fix `597cbb1d767ae92c44b4cbd9525fa53ddab37117`, parent (fix^1) `fe6308b281ded7377c927b78fb0390d5816ba492`
- advisory title: Missing permission check in Jenkins CloudBees CD Plugin allows scheduling builds
| id | path::function (pre-fix lines) | language | entry point (verifier) | confidence |
|---|---|---|---|---|
| `jenkinsci-electricflow-plugin-b319df3a71ebd890` | `src/main/java/org/jenkinsci/plugins/electricflow/rest/ElectricFlowEFRunAPIAction.java::doBuild` (71-189) | java | HTTP POST to the ElectricFlowEFRunAPIAction endpoint (getUrlName() URL_NAME) invoking doBuild(StaplerRequest, StaplerResponse); attacker-controlled JSON body read via req.getReader() supplies flowRunt | 0.9 |
## jenkinsci/git-plugin
- advisory: GHSA-449w-c77c-vmf6 (access_control, CWE-306), origin `?`, ecosystem ?, licence ?
- fix `b46165c74a0bf15e08763de2e506005624d5d238`, parent (fix^1) `18577d14afa2d1fbf970c44f60fce426d083073b`
- advisory title: Lack of authentication mechanism in Jenkins Git Plugin webhook
| id | path::function (pre-fix lines) | language | entry point (verifier) | confidence |
|---|---|---|---|---|
| `jenkinsci-git-plugin-751c41fb6795520f` | `src/main/java/hudson/plugins/git/GitStatus.java::doNotifyCommit` (115-177) | java | /git/notifyCommit webhook endpoint handled by GitStatus.doNotifyCommit(HttpServletRequest, url, branches, sha1) | 0.95 |
## jenkinsci/global-build-stats-plugin
- advisory: GHSA-gm8g-fh49-qq6v (access_control, CWE-284), origin `?`, ecosystem ?, licence ?
- fix `32aeb0493c4ff5423448576f477ac612f7a25138`, parent (fix^1) `6478447abafa3d984bdfb4f73a358b68a97bdcf3`
- advisory title: Jenkins global-build-stats Plugin missing permission check can result in graph IDs being enumerated
| id | path::function (pre-fix lines) | language | entry point (verifier) | confidence |
|---|---|---|---|---|
| `jenkinsci-global-build-stats-plugin-b2560994597ff44f` | `src/main/java/hudson/plugins/global_build_stats/GlobalBuildStatsPlugin.java::doPython` (130-136) | java | GlobalBuildStatsApi.doPython (and doJson/doXml) REST API endpoint via Stapler, source: buildStatConfigId request parameter | 0.9 |
| `jenkinsci-global-build-stats-plugin-ee8d1b0fdf63b4ee` | `src/main/java/hudson/plugins/global_build_stats/GlobalBuildStatsPlugin.java::doJson` (123-129) | java | GlobalBuildStatsApi.doJson (REST API endpoint /api/json via getApi()), source: buildStatConfigId request parameter | 0.85 |
## jenkinsci/groovy-plugin
- advisory: GHSA-xfwj-2f34-32f5 (access_control, CWE-862), origin `?`, ecosystem ?, licence ?
- fix `212e048a319ae32dad4cfec5e73a885a9f4781f0`, parent (fix^1) `da0739d3507c5973d506d18efbda33ad5e37893b`
- advisory title: Jenkins Groovy Plugin sandbox bypass vulnerability
| id | path::function (pre-fix lines) | language | entry point (verifier) | confidence |
|---|---|---|---|---|
| `jenkinsci-groovy-plugin-74141466f39e1a12` | `src/main/java/hudson/plugins/groovy/StringScriptSource.java::doCheckScript` (65-77) | java | Jenkins HTTP endpoint invoking DescriptorImpl.doCheckScript with @QueryParameter String command (Groovy command script source descriptor) | 0.85 |
## jenkinsci/hashicorp-vault-plugin
- advisory: GHSA-vpf7-q2rx-26mh (access_control, CWE-862), origin `?`, ecosystem ?, licence ?
- fix `3b38d767aba8bd98d6f4fb53c1f1678d95b5e752`, parent (fix^1) `db858fd6bf48b0784598b8f1b12d006c8d6dec98`
- advisory title: Jenkins HashiCorp Vault Plugin does not perform permission checks in several HTTP endpoints that perform Vault connection tests
| id | path::function (pre-fix lines) | language | entry point (verifier) | confidence |
|---|---|---|---|---|
| `jenkinsci-hashicorp-vault-plugin-4b8dac7099e598b2` | `src/main/java/com/datapipe/jenkins/vault/credentials/common/VaultUsernamePasswordCredentialImpl.java::doTestConnection` (81-105) | java | Jenkins Stapler HTTP endpoint DescriptorImpl.doTestConnection (Vault Username-Password Credential descriptor), invoked via form validation request with attacker-controlled query parameters path, usern | 0.9 |
| `jenkinsci-hashicorp-vault-plugin-69b136827df9a5c0` | `src/main/java/com/datapipe/jenkins/vault/credentials/common/VaultSSHUserPrivateKeyImpl.java::doTestConnection` (115-147) | java | Jenkins Stapler HTTP endpoint doTestConnection on VaultSSHUserPrivateKeyImpl.DescriptorImpl (e.g. /descriptorByName/.../testConnection), with attacker-controlled query parameters path, usernameKey, pr | 0.9 |
| `jenkinsci-hashicorp-vault-plugin-7782cfb6ae3f0339` | `src/main/java/com/datapipe/jenkins/vault/credentials/common/VaultStringCredentialImpl.java::doTestConnection` (59-75) | java | Jenkins Stapler HTTP endpoint doTestConnection on VaultStringCredentialImpl.DescriptorImpl, invoked via the credential configuration form with attacker-controlled query parameters path, vaultKey, pref | 0.85 |
| `jenkinsci-hashicorp-vault-plugin-9f7965aeec3cc869` | `src/main/java/com/datapipe/jenkins/vault/credentials/common/VaultCertificateCredentialsImpl.java::doTestConnection` (139-162) | java | Jenkins Stapler HTTP endpoint DescriptorImpl.doTestConnection (e.g. /descriptorByName/.../testConnection) with @QueryParameter path/keyStoreKey/passwordKey/prefixPath/namespace/engineVersion | 0.85 |
| `jenkinsci-hashicorp-vault-plugin-c76a541ee22b2ef9` | `src/main/java/com/datapipe/jenkins/vault/credentials/common/VaultFileCredentialImpl.java::doTestConnection` (91-120) | java | Jenkins Stapler HTTP endpoint doTestConnection on VaultFileCredentialImpl.DescriptorImpl (e.g. /descriptorByName/com.datapipe.jenkins.vault.credentials.common.VaultFileCredentialImpl/testConnection), | 0.85 |
| `jenkinsci-hashicorp-vault-plugin-e7d568b004427b1d` | `src/main/java/com/datapipe/jenkins/vault/credentials/common/VaultGCRLoginImpl.java::doTestConnection` (60-78) | java | Jenkins Stapler HTTP endpoint DescriptorImpl.doTestConnection (e.g. /descriptorByName/.../testConnection) with @QueryParameter path/prefixPath/namespace/engineVersion | 0.85 |
## jenkinsci/jiratestresultreporter-plugin
- advisory: GHSA-gc7m-x2cj-3775 (access_control, CWE-862), origin `?`, ecosystem ?, licence ?
- fix `0cc6208295b5cb683528e8bf04d139f0bee8eb53`, parent (fix^1) `81792855394237a2f78b06f509985a894ac5c008`
- advisory title: Missing permission check in Jenkins JiraTestResultReporter Plugin
| id | path::function (pre-fix lines) | language | entry point (verifier) | confidence |
|---|---|---|---|---|
| `jenkinsci-jiratestresultreporter-plugin-28213733c6b799eb` | `src/main/java/org/jenkinsci/plugins/JiraTestResultReporter/JiraTestDataPublisher.java::doValidateGlobal` (511-544) | java | Jenkins Stapler HTTP endpoint doValidateGlobal on JiraTestDataPublisher (global.jelly 'Validate Settings' button), parameters jiraUrl/username/password | 0.9 |
## jenkinsci/jx-resources-plugin
- advisory: GHSA-xqqr-mq8x-22qx (access_control, CWE-862), origin `?`, ecosystem ?, licence ?
- fix `f0d9fb76230b65e851095da936a439d953c5f64d`, parent (fix^1) `520f0a91dd01f404d29cee07433635e43c474294`
- advisory title: Jenkins JX Resources Plugin missing permission check
| id | path::function (pre-fix lines) | language | entry point (verifier) | confidence |
|---|---|---|---|---|
| `jenkinsci-jx-resources-plugin-e1eb49dbe32bfc7a` | `src/main/java/org/jenkinsci/plugins/jx/resources/GlobalPluginConfiguration.java::doValidateClient` (129-141) | java | Jenkins form validation endpoint doValidateClient (GlobalPluginConfiguration), invoked via Jenkins form validation HTTP request with attacker-controlled 'server' and 'namespace' query parameters | 0.85 |
## jenkinsci/mabl-integration-plugin
- advisory: GHSA-m9jj-p947-m8xv (access_control, CWE-862), origin `?`, ecosystem ?, licence ?
- fix `4e21f498b0704d62f5a6114fcd8c274a5f440b18`, parent (fix^1) `61281f28815b3e05ca3d156f5b080fdde34ba1df`
- advisory title: Jenkins mabl Plugin missing permission check
| id | path::function (pre-fix lines) | language | entry point (verifier) | confidence |
|---|---|---|---|---|
| `jenkinsci-mabl-integration-plugin-010c7741299085f7` | `src/main/java/com/mabl/integration/jenkins/MablStepBuilder.java::doFillApplicationIdItems` (361-382) | java | Jenkins Stapler HTTP endpoint doFillApplicationIdItems (e.g. /job/<name>/descriptorByName/com.mabl.integration.jenkins.MablStepBuilder/fillApplicationIdItems) with attacker-controlled query parameters | 0.85 |
| `jenkinsci-mabl-integration-plugin-33601449707f721c` | `src/main/java/com/mabl/integration/jenkins/MablStepBuilder.java::doFillRestApiKeyIdItems` (328-342) | java | Jenkins Stapler HTTP endpoint doFillRestApiKeyIdItems (e.g. /job/<name>/descriptorByName/com.mabl.integration.jenkins.MablStepBuilder/fillRestApiKeyIdItems) invoked with attacker-controlled restApiKey | 0.85 |
| `jenkinsci-mabl-integration-plugin-5f366608a3d422b4` | `src/main/java/com/mabl/integration/jenkins/MablStepBuilder.java::getApplicationIdItems` (384-407) | java | doFillApplicationIdItems HTTP endpoint (Jenkins Stapler @QueryParameter restApiKeyId, disableSslVerification, apiBaseUrl, appBaseUrl) reachable by users with Overall/Read permission | 0.85 |
| `jenkinsci-mabl-integration-plugin-60b82fbf81b044f5` | `src/main/java/com/mabl/integration/jenkins/MablStepBuilder.java::doCheckRestApiKeyIds` (344-359) | java | Jenkins Stapler HTTP endpoint doCheckRestApiKeyIds (and doFillApplicationIdItems) on MablStepBuilder, invoked via the mabl build step configuration form; attacker-controlled source is the @QueryParame | 0.85 |
| `jenkinsci-mabl-integration-plugin-8cc76fc9d5aa0984` | `src/main/java/com/mabl/integration/jenkins/MablStepBuilder.java::doFillEnvironmentIdItems` (409-426) | java | Jenkins Stapler HTTP endpoint doFillEnvironmentIdItems (MablStepBuilder), reachable via GET/POST to the descriptor fill URL with attacker-controlled query parameters restApiKeyId, disableSslVerificati | 0.85 |
| `jenkinsci-mabl-integration-plugin-b2206be4bf8e37fb` | `src/main/java/com/mabl/integration/jenkins/MablStepBuilder.java::doValidateForm` (316-326) | java | MablStepDescriptor.doValidateForm HTTP endpoint (Stapler @QueryParameter restApiKeyId/environmentId/applicationId/disableSslVerification/apiBaseUrl/appBaseUrl) | 0.85 |
| `jenkinsci-mabl-integration-plugin-c9df9fe333e3ed08` | `src/main/java/com/mabl/integration/jenkins/MablStepBuilder.java::getEnvironmentIdItems` (428-466) | java | doFillEnvironmentIdItems (Jenkins Stapler HTTP endpoint, @QueryParameter restApiKeyId/apiBaseUrl/appBaseUrl/disableSslVerification) | 0.85 |
## jenkinsci/nomad-plugin
- advisory: GHSA-p278-2qh9-6mwj (access_control, CWE-862), origin `?`, ecosystem ?, licence ?
- fix `93ea215a649575e4063e1dfe8361b684c29a91e3`, parent (fix^1) `fe2cc9498561b357c7b1a17fc3b76a492abff755`
- advisory title: Jenkins Nomad Plugin missing permission check
| id | path::function (pre-fix lines) | language | entry point (verifier) | confidence |
|---|---|---|---|---|
| `jenkinsci-nomad-plugin-81a6fad8feb01b11` | `src/main/java/org/jenkinsci/plugins/nomad/NomadCloud.java::doCheckName` (224-233) | java | NomadCloud.DescriptorImpl#doCheckName form validation endpoint (Jenkins Stapler HTTP route /descriptorByName/org.jenkinsci.plugins.nomad.NomadCloud/checkName), source: @QueryParameter String name | 0.75 |
## jenkinsci/opentelemetry-plugin
- advisory: GHSA-f696-867g-2759 (access_control, CWE-862), origin `?`, ecosystem ?, licence ?
- fix `f5a4ec123769096ad9a4930ede56588b0fee40f3`, parent (fix^1) `26675a20647122918cb1cf154470e7e71ff1882f`
- advisory title: Jenkins OpenTelemetry Plugin missing permission check allows capturing credentials
| id | path::function (pre-fix lines) | language | entry point (verifier) | confidence |
|---|---|---|---|---|
| `jenkinsci-opentelemetry-plugin-62ce6dc3488e0d80` | `src/main/java/io/jenkins/plugins/opentelemetry/backend/elastic/ElasticLogsBackendWithJenkinsVisualization.java::doCheckElasticsearchCredentialsId` (157-173) | java | Jenkins Stapler HTTP endpoint doCheckElasticsearchCredentialsId (form validation for ElasticLogsBackendWithJenkinsVisualization), invoked via POST with elasticsearchCredentialsId query parameter by a | 0.85 |
| `jenkinsci-opentelemetry-plugin-c258c6ed37f2c061` | `src/main/java/io/jenkins/plugins/opentelemetry/backend/elastic/ElasticLogsBackendWithJenkinsVisualization.java::doFillElasticsearchCredentialsIdItems` (144-154) | java | Jenkins Stapler HTTP endpoint doFillElasticsearchCredentialsIdItems on the ElasticLogsBackendWithJenkinsVisualization.DescriptorImpl (invoked via the plugin configuration form, e.g. /descriptorByName/ | 0.75 |
| `jenkinsci-opentelemetry-plugin-e7dc96d707803ae7` | `src/main/java/io/jenkins/plugins/opentelemetry/backend/elastic/ElasticLogsBackendWithJenkinsVisualization.java::doCheckElasticsearchUrl` (131-197) | java | Jenkins Stapler HTTP endpoint DescriptorImpl.doValidate (and doCheckElasticsearchUrl/doCheckElasticsearchCredentialsId) invoked via form validation request with attacker-controlled elasticsearchUrl an | 0.85 |
| `jenkinsci-opentelemetry-plugin-f0ff00bf7375eb29` | `src/main/java/io/jenkins/plugins/opentelemetry/backend/elastic/ElasticLogsBackendWithJenkinsVisualization.java::doValidate` (176-195) | java | Jenkins Stapler HTTP endpoint doValidate on ElasticLogsBackendWithJenkinsVisualization (POST form validation), attacker-controlled elasticsearchUrl and elasticsearchCredentialsId query parameters | 0.85 |
## jenkinsci/rocketchatnotifier-plugin
- advisory: GHSA-4p8f-2fwv-6xcw (access_control, CWE-862), origin `?`, ecosystem ?, licence ?
- fix `1a0023be9f2e143434d028d5292ef9dc3195d051`, parent (fix^1) `14cdaa96d98d6d65fbefde1103a04bc478edf415`
- advisory title: Missing permission check in Jenkins RocketChat Notifier Plugin
| id | path::function (pre-fix lines) | language | entry point (verifier) | confidence |
|---|---|---|---|---|
| `jenkinsci-rocketchatnotifier-plugin-16d28ce862d5a528` | `src/main/java/jenkins/plugins/rocketchatnotifier/RocketChatNotifier.java::doTestConnection` (581-647) | java | Jenkins Stapler form validation endpoint doTestConnection (e.g. /descriptorByName/jenkins.plugins.rocketchatnotifier.RocketChatNotifier/doTestConnection) with attacker-controlled query parameters rock | 0.9 |
## jenkinsci/support-core-plugin
- advisory: GHSA-w2j3-pq63-339w (access_control, CWE-863), origin `?`, ecosystem ?, licence ?
- fix `9b7a1d48db0fdfb840ca3393e9462e687e69385b`, parent (fix^1) `abaff0102139d9ec56ce3905f2ffef27649c88a4`
- advisory title: Incorrect permission checks in Jenkins Support Core Plugin
| id | path::function (pre-fix lines) | language | entry point (verifier) | confidence |
|---|---|---|---|---|
| `jenkinsci-support-core-plugin-3de9ccb2591c7490` | `src/main/java/com/cloudbees/jenkins/support/SupportCommand.java::run` (77-122) | java | Jenkins CLI command 'support' (SupportCommand.run) invoked via CLI channel; attacker-controlled source is the CLI invocation by a user holding Support/DownloadBundle permission | 0.85 |
| `jenkinsci-support-core-plugin-934a17bf668da541` | `src/main/java/com/cloudbees/jenkins/support/SupportAction.java::Restricted` (89-93) | java | SupportAction (RootAction, urlName "support") via StaplerProxy getTarget(); HTTP request to /support/... reaches getTarget() which checks CREATE_BUNDLE (Support/DownloadBundle) instead of Jenkins.ADMI | 0.85 |
## kimai/kimai
- advisory: GHSA-9w8f-7wgr-2h7g (access_control, CWE-284), origin `?`, ecosystem ?, licence ?
- fix `ff9acab0fc81f0e9490462739ef15fe4ab028ea5`, parent (fix^1) `76e09447c85e762882126b49626a4fe4d93fe8b5`
- advisory title: kimai2 is vulnerable to Improper Access Control
| id | path::function (pre-fix lines) | language | entry point (verifier) | confidence |
|---|---|---|---|---|
| `kimai-kimai-166480170479d403` | `src/Controller/InvoiceController.php::createInvoiceAction` (166-185) | php | GET /save-invoice/{customer}/{template} (route name invoice_create) in InvoiceController::createInvoiceAction | 0.75 |
| `kimai-kimai-5e04ee92bdb735ea` | `src/Controller/InvoiceController.php::previewAction` (136-165) | php | GET /preview/{customer}/{template} route (invoice_preview) in InvoiceController::previewAction; attacker-controlled source is the {customer} route parameter (Customer entity) and {template} parameter, | 0.85 |
## mage-ai/mage-ai
- advisory: GHSA-c6mm-2g84-v4m7 (access_control, CWE-306), origin `?`, ecosystem ?, licence ?
- fix `f63cd00f6a3be372397d37a4c9a49bfaf50d7650`, parent (fix^1) `e16a64962d540046b1210b5b749897cf600f0ed3`
- advisory title: Mage-ai missing user authentication
| id | path::function (pre-fix lines) | language | entry point (verifier) | confidence |
|---|---|---|---|---|
| `mage-ai-mage-ai-c9810ee637c308c0` | `mage_ai/server/terminal_server.py::open` (54-93) | python | WebSocket TerminalWebsocketServer.open (terminal_server.py) via /terminals/websocket route; attacker-controlled source: websocket query arguments api_key, token, cwd, term_name | 0.85 |
| `mage-ai-mage-ai-d1ee6d54adc38f57` | `mage_ai/frontend/components/Terminal/index.tsx::Terminal` (43-407) | typescript | Terminal component (mage_ai/frontend/components/Terminal/index.tsx) rendered in the Mage web UI; keyboard input via registerOnKeyDown and sendMessage WebSocket channel | 0.6 |
benchmarks/valid/train/catalog_access_control.toml
+2663
View File
File diff suppressed because one or more lines are too long
benchmarks/valid/train/sources_access_control.json
-294
View File
@@ -1,32 +1,4 @@
[
{
"repository": "payloadcms/payload",
"repo": "payloadcms/payload",
"url": "https://github.com/payloadcms/payload.git",
"fix": "19b58692d20d3947f31124bf7a88ac14a5ebf02e",
"parent": "b8fc06a18afb6974dc07f95ac1e541c716e5926b",
"family": "access_control",
"cwe": "CWE-862",
"advisory": "GHSA-p96c-xwx8-3cqj",
"advisory_text": "Payload has a tenant authorization bypass in Multi-Tenant Plugin\n\n## Impact\n\nWhen using the default tenant array field access, an authenticated user could assign themselves to other tenants.\n\n**You are affected if:**\n\n- You are using `@payloadcms/plugin-multi-tenant`\n\nIf you configure the tenants arrayFieldAccess.create/update functions, a secured replacement membership field, you are not affected by this specific default behavior.\n\n## Patches\n\nUsers should upgrade Payload packages to `>= 3.90.0` or `>= 4.0.0-canary.34`.\n\n## Workarounds\n\nConfigure tenants arrayFieldAccess.create and tenants arrayFieldAccess.update so only trusted users authorized for all tenants can modify memberships.",
"ecosystem": "npm",
"license_spdx": "MIT",
"origin": "osv"
},
{
"repository": "unshiftio/url-parse",
"repo": "unshiftio/url-parse",
"url": "https://github.com/unshiftio/url-parse.git",
"fix": "0e3fb542d60ddbf6933f22eb9b1e06e25eaa5b63",
"parent": "61864a8eccff714a45d23db85a814e3c6ee0baba",
"family": "access_control",
"cwe": "CWE-639",
"advisory": "GHSA-jf5r-8hm2-f872",
"advisory_text": "url-parse incorrectly parses hostname / protocol due to unstripped leading control characters.\n\nLeading control characters in a URL are not stripped when passed into url-parse. This can cause input URLs to be mistakenly be interpreted as a relative URL without a hostname and protocol, while the WHATWG URL parser will trim control characters and treat it as an absolute URL.\n\nIf url-parse is used in security decisions involving the hostname / protocol, and the input URL is used in a client which uses the WHATWG URL parser, the decision may be incorrect.\n\nThis can also lead to a cross-site scripting (XSS) vulnerability if url-parse is used to check for the javascript: protocol in URLs. See following example:\n```js\nconst parse = require('url-parse')\nconst express = require('express')\nconst app = express()\nconst port = 3000\n\nurl = parse(\\\"\\\\bjavascript:alert(1)\\\")\n\nconsole.log(url)\n\napp.get('/', (req, res) => {\n if (url.protocol !== \\\"javascript:\\\") {res.send(\\\"<a href=\\\\'\\\" + url.href + \\\"\\\\'>CLICK ME!</a>\\\")}\n })\n\napp.listen(port, () => {\n console.log(`Example app listening on port ${port}`)\n })\n```",
"ecosystem": "npm",
"license_spdx": "MIT",
"origin": "osv"
},
{
"repository": "auth0/symfony",
"repo": "auth0/symfony",
@@ -69,20 +41,6 @@
"license_spdx": "MIT",
"origin": "osv"
},
{
"repository": "yonle/bostr",
"repo": "yonle/bostr",
"url": "https://github.com/Yonle/bostr.git",
"fix": "49181f4ec9ae1472c6675cab56bbc01e723855af",
"parent": "8b131e239b92db889ac5d8fd02bee1d3a035fd9d",
"family": "access_control",
"cwe": "CWE-285",
"advisory": "GHSA-5cf7-cxrf-mq73",
"advisory_text": "Bostr Improper Authorization vulnerability\n\nEven with `authorized_keys` is filled with allowed pubkeys, If `noscraper` is enabled, It will allow anyone to use bouncer even it's pubkey is not in `authorized_keys`.\n\n### Impact\n- Private bouncer\n\n### Patches\nAvailable on version [3.0.10](https://github.com/Yonle/bostr/releases/tag/3.0.10)\n\n### Workarounds\nDisable `noscraper` if you have `authorized_keys` being set in config\n\n### References\nThis [line of code](https://github.com/Yonle/bostr/blob/8665374a66e2afb9f92d0414b0d6f420a95d5d2d/auth.js#L21) is the cause.",
"ecosystem": "npm",
"license_spdx": "BSD-3-Clause",
"origin": "osv"
},
{
"repository": "ionicabizau/parse-path",
"repo": "ionicabizau/parse-path",
@@ -111,20 +69,6 @@
"license_spdx": "Apache-2.0",
"origin": "osv"
},
{
"repository": "scrapy/scrapy",
"repo": "scrapy/scrapy",
"url": "https://github.com/scrapy/scrapy.git",
"fix": "8ce01b3b76d4634f55067d6cfdf632ec70ba304a",
"parent": "aa0306a167ef34b23cc2ec407a48359a4b5a8d0a",
"family": "access_control",
"cwe": "CWE-863",
"advisory": "GHSA-cjvr-mfj7-j4j8",
"advisory_text": "Incorrect Authorization and Exposure of Sensitive Information to an Unauthorized Actor in scrapy\n\n### Impact\n\nIf you manually define cookies on a [`Request`](https://docs.scrapy.org/en/latest/topics/request-response.html#scrapy.http.Request) object, and that `Request` object gets a redirect response, the new `Request` object scheduled to follow the redirect keeps those user-defined cookies, regardless of the target domain.\n\n### Patches\n\nUpgrade to Scrapy 2.6.0, which resets cookies when creating `Request` objects to follow redirects¹, and drops the ``Cookie`` header if manually-defined if the redirect target URL domain name does not match the source URL domain name².\n\nIf you are using Scrapy 1.8 or a lower version, and upgrading to Scrapy 2.6.0 is not an option, you may upgrade to Scrapy 1.8.2 instead.\n\n¹ At that point the original, user-set cookies have been processed by the cookie middleware into the global or request-specific cookiejar, with their domain restricted to the domain of the original URL, so when the cookie middleware processes the new (redirect) request it will incorporate those cookies into the new request as long as the domain of the new request matches the domain of the original request.\n\n² This prevents cookie leaks to unintended domains even if the cookies middleware is not used.\n\n### Workarounds\n\nIf you cannot upgrade, set your cookies using a list of dictionaries instead of a single dictionary, as described in the [`Request` documentation](https://docs.scrapy.org/en/latest/topics/request-response.html#scrapy.http.Request), and set the right domain for each cookie.\n\nAlternatively, you can [disable cookies altogether](https://docs.scrapy.org/en/latest/topics/downloader-middleware.html#std-setting-COOKIES_ENABLED), or [limit target domains](https://docs.scrapy.org/en/latest/topics/spiders.html#scrapy.spiders.Spider.allowed_domains) to domains that you trust with all your user-set cookies.\n\n### References\n* Originally reported at [huntr.dev](https://huntr.dev/bounties/3da527b1-2348-4f69-9e88-2e11a96ac585/)\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n* [Open an issue](https://github.com/scrapy/scrapy/issues)\n* [Email us](mailto:[email protected])",
"ecosystem": "pip",
"license_spdx": "BSD-3-Clause",
"origin": "osv"
},
{
"repository": "googlechrome/rendertron",
"repo": "googlechrome/rendertron",
@@ -237,20 +181,6 @@
"license_spdx": "Unlicense",
"origin": "osv"
},
{
"repository": "openzeppelin/cairo-contracts",
"repo": "openzeppelin/cairo-contracts",
"url": "https://github.com/OpenZeppelin/cairo-contracts.git",
"fix": "2cd60279c3332285d47edf9ee3888b71257acdc9",
"parent": "f7d319fb19b9afe868034283d66062ae83da649a",
"family": "access_control",
"cwe": "CWE-863",
"advisory": "GHSA-8mjr-jr5h-q2xr",
"advisory_text": "OpenZeppelin Contracts for Cairo account cannot process transactions on Goerli\n\n### Impact\nThis vulnerability affects all accounts (vanilla and ethereum flavors) in the [v0.2.0 release of OpenZeppelin Contracts for Cairo](https://github.com/OpenZeppelin/cairo-contracts/releases/tag/v0.2.0), which are not whitelisted on StarkNet mainnet, so only goerli deployments of v0.2.0 accounts are affected.\n\nThis faulty behavior is not observed in [StarkNet's testing framework](https://github.com/starkware-libs/cairo-lang/blob/master/src/starkware/starknet/testing/starknet.py), so don't rely on it passing to detect this issue on custom accounts.\n\n### Patches\nThis bug has been patched in [v0.2.1](https://github.com/OpenZeppelin/cairo-contracts/releases/tag/v0.2.1).\n\n### References\nThe issue is detailed in https://github.com/OpenZeppelin/cairo-contracts/issues/386.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [the Contracts for Cairo repo](https://github.com/OpenZeppelin/cairo-contracts/issues/new/choose)\n* Email us at [[email protected]](mailto:[email protected])",
"ecosystem": "pip",
"license_spdx": "MIT",
"origin": "osv"
},
{
"repository": "jenkinsci/azure-keyvault-plugin",
"repo": "jenkinsci/azure-keyvault-plugin",
@@ -321,20 +251,6 @@
"license_spdx": "MIT",
"origin": "osv"
},
{
"repository": "mercurius-js/mercurius",
"repo": "mercurius-js/mercurius",
"url": "https://github.com/mercurius-js/mercurius.git",
"fix": "5b56f60f4b0d60780b0ff499a479bd830bdd6986",
"parent": "249809aed8c6bcb98c1d53404c6896b32e1f29e1",
"family": "access_control",
"cwe": "CWE-863",
"advisory": "GHSA-m4h2-mjfm-mp55",
"advisory_text": "Mercurius's queryDepth limit bypassed for WebSocket subscriptions\n\n## Description\n\nMercurius fails to enforce the configured queryDepth limit on GraphQL subscription queries received over WebSocket connections. The depth check is correctly applied to HTTP queries and mutations, but subscription queries are parsed and executed without invoking the depth validation. This allows a remote client to submit arbitrarily deeply nested subscription queries over WebSocket, bypassing the intended depth restriction. On schemas with recursive types, this can lead to denial of service through exponential data resolution on each subscription event.\n\n## Workarounds\n\nDisable subscriptions and, in general, queries over the WebSocket.",
"ecosystem": "npm",
"license_spdx": "MIT",
"origin": "osv"
},
{
"repository": "arthurfiorette/axios-cache-interceptor",
"repo": "arthurfiorette/axios-cache-interceptor",
@@ -377,62 +293,6 @@
"license_spdx": "MIT",
"origin": "osv"
},
{
"repository": "web-auth/webauthn-framework",
"repo": "web-auth/webauthn-framework",
"url": "https://github.com/web-auth/webauthn-framework.git",
"fix": "572e239c5702667ca52487faf861abc768a46308",
"parent": "de5cd2451e74220708ba5ac891a3c97ce87e7011",
"family": "access_control",
"cwe": "CWE-863",
"advisory": "GHSA-6whf-q6p5-84wg",
"advisory_text": "Improper Access Control in Webauthn Framework\n\nWebauthn Framework 3.3.x before 3.3.4 has Incorrect Access Control. An attacker that controls a user's system is able to login to a vulnerable service using an attached FIDO2 authenticator without passing a check of the user presence.",
"ecosystem": "composer",
"license_spdx": "MIT",
"origin": "osv"
},
{
"repository": "medialize/uri.js",
"repo": "medialize/uri.js",
"url": "https://github.com/medialize/URI.js.git",
"fix": "6ea641cc8648b025ed5f30b090c2abd4d1a5249f",
"parent": "19e54c78d5864aec43986e8f96be8d15998daa80",
"family": "access_control",
"cwe": "CWE-639",
"advisory": "GHSA-gcv8-gh4r-25x6",
"advisory_text": "Authorization Bypass Through User-Controlled Key in urijs\n\nAttacker can use case-insensitive protocol schemes like HTTP, htTP, HTtp etc. in order to bypass the patch for CVE-2021-3647.",
"ecosystem": "npm",
"license_spdx": "MIT",
"origin": "osv"
},
{
"repository": "thinkst/opencanary",
"repo": "thinkst/opencanary",
"url": "https://github.com/thinkst/opencanary.git",
"fix": "2c11575b1a3dd8b0df26a879ba856c0aa350c049",
"parent": "d3956bc602f95d2bec55eebc96d5e3a2cb35bf47",
"family": "access_control",
"cwe": "CWE-863",
"advisory": "GHSA-pf5v-pqfv-x8jj",
"advisory_text": "OpenCanary Executes Commands From Potentially Writable Config File\n\n### Impact\n\nOpenCanary directly executed commands taken from its config file. Where the config file is stored in an unprivileged user directory but the daemon is executed by root, it’s possible for the unprivileged user to change the config file and escalate permissions when root later runs the daemon.\n\nThanks to the folks at [Whirlylabs](https://whirlylabs.com/) for finding and fixing this.\n\n### Patches\n\nUpgrade to 0.9.4 or higher.",
"ecosystem": "pip",
"license_spdx": "BSD-3-Clause",
"origin": "osv"
},
{
"repository": "openstack/barbican",
"repo": "openstack/barbican",
"url": "https://github.com/openstack/barbican.git",
"fix": "7d270bacbe29a90a10f1855abc3b50dac0f08022",
"parent": "8bd16953ebb11c38c02151687967ee93c88067d7",
"family": "access_control",
"cwe": "CWE-863",
"advisory": "GHSA-p2jg-q8hw-p7gc",
"advisory_text": "Barbican authorization flaw before v14.0.0\n\nAn authorization flaw was found in openstack-barbican. The default policy rules for the secret metadata API allowed any authenticated user to add, modify, or delete metadata from any secret regardless of ownership. This flaw allows an attacker on the network to modify or delete protected data, causing a denial of service by consuming protected resources.",
"ecosystem": "pip",
"license_spdx": "Apache-2.0",
"origin": "osv"
},
{
"repository": "jenkinsci/compuware-topaz-utilities-plugin",
"repo": "jenkinsci/compuware-topaz-utilities-plugin",
@@ -461,20 +321,6 @@
"license_spdx": "Apache-2.0",
"origin": "osv"
},
{
"repository": "parisneo/lollms",
"repo": "parisneo/lollms",
"url": "https://github.com/ParisNeo/lollms.git",
"fix": "a3b2b82b84d537a9da63e63a370a6a8ad55fed34",
"parent": "a2f10ca90129cd8a3a01474562d50d3089eb8c85",
"family": "access_control",
"cwe": "CWE-284",
"advisory": "GHSA-9296-v3fr-j92j",
"advisory_text": "LoLLMs is vulnerable to Improper Access Control through weak secret key\n\nIn parisneo/lollms version 2.1.0, the application's session management is vulnerable to improper access control due to the use of a weak secret key for signing JSON Web Tokens (JWT). This vulnerability allows an attacker to perform an offline brute-force attack to recover the secret key. Once the secret key is obtained, the attacker can forge administrative tokens by modifying the JWT payload and resigning it with the cracked secret. This enables unauthorized users to escalate privileges, impersonate the administrator, and gain access to restricted endpoints. The issue is resolved in version 2.2.0.",
"ecosystem": "pip",
"license_spdx": "Apache-2.0",
"origin": "osv"
},
{
"repository": "aws/aws-dynamodb-encryption-java",
"repo": "aws/aws-dynamodb-encryption-java",
@@ -517,20 +363,6 @@
"license_spdx": "MIT",
"origin": "osv"
},
{
"repository": "tomasvotava/fastapi-sso",
"repo": "tomasvotava/fastapi-sso",
"url": "https://github.com/tomasvotava/fastapi-sso.git",
"fix": "6117d1a5ad498ba57d671e8a059ebe20db5abe02",
"parent": "da63c19bca7db0fe8a7e66d03fdf07154ec7182a",
"family": "access_control",
"cwe": "CWE-285",
"advisory": "GHSA-hp6r-r9vc-q8wx",
"advisory_text": "FastAPI SSP is vulnerable to Cross-site Request Forgery (CSRF) through improper OAuth parameter validation\n\nVersions of the package fastapi-sso before 0.19.0 are vulnerable to Cross-site Request Forgery (CSRF) due to the improper validation of the OAuth state parameter during the authentication callback. While the get_login_url method allows for state generation, it does not persist the state or bind it to the user's session. Consequently, the verify_and_process method accepts the state received in the query parameters without verifying it against a trusted local value. This allows a remote attacker to trick a victim into visiting a malicious callback URL, which can result in the attacker's account being linked to the victim's internal account.",
"ecosystem": "pip",
"license_spdx": "MIT",
"origin": "osv"
},
{
"repository": "jenkinsci/gitea-plugin",
"repo": "jenkinsci/gitea-plugin",
@@ -545,20 +377,6 @@
"license_spdx": "MIT",
"origin": "osv"
},
{
"repository": "neuron-core/neuron-ai",
"repo": "neuron-core/neuron-ai",
"url": "https://github.com/neuron-core/neuron-ai.git",
"fix": "44bab85d92bf162898ee48d0bcef6ba0d29b59c9",
"parent": "72735d0ea133266cf2f5d5d195d41e9dd865289a",
"family": "access_control",
"cwe": "CWE-284",
"advisory": "GHSA-898v-775g-777c",
"advisory_text": "Neuron MySQLWriteTool allows arbitrary/destructive SQL when exposed to untrusted prompts (agent “footgun”)\n\n### Impact\n\n`MySQLWriteTool` executes arbitrary SQL provided by the caller using `PDO::prepare()` + `execute()` without semantic restrictions. \n\nThis is consistent with the name (“write tool”), but in an LLM/agent context it becomes a high-risk capability: prompt injection or indirect prompt manipulation can cause execution of destructive queries such as `DROP TABLE`, `TRUNCATE`, `DELETE`, `ALTER`, or privilege-related statements (subject to DB permissions).\n\n\n\n**Who is impacted:** Deployments that expose an agent with `MySQLWriteTool` enabled to untrusted input and/or run the tool with a DB user that has broad privileges.\n\n### Patches\n\n**Not patched in:** 2.8.11 \n\nRecommended improvements (even if keeping the tool intentionally powerful):\n\n- Provide a safer API that supports only constrained operations (e.g., `insertRecord`, `updateRecord`) with allowlisted tables/columns.\n\n- Add a policy/allowlist layer (e.g., allow only `INSERT`/`UPDATE` on selected tables; forbid `DROP/TRUNCATE/ALTER/GRANT`).\n\n- Add optional review workflow: log + require human approval for high-risk statements; or “dry-run” mode.\n\n- Document strongly that the tool must not be exposed to untrusted prompts without additional safeguards.\n\n\n\n### Workarounds\n\n- Do not enable `MySQLWriteTool` for public/untrusted agents.\n\n- Use a dedicated DB user with **least privilege**:\n\n - no `DROP`, no `ALTER`, no `GRANT`, no access to sensitive tables unless necessary\n\n- Add an application-layer policy rejecting high-risk statements (`DROP`, `TRUNCATE`, `ALTER`, `GRANT`, `REVOKE`, `CREATE USER`, etc.).\n\n- Implement authorization gating for tool calls (RBAC, allow tool use only for trusted operators).",
"ecosystem": "composer",
"license_spdx": "MIT",
"origin": "osv"
},
{
"repository": "jenkinsci/compuware-topaz-for-total-test-plugin",
"repo": "jenkinsci/compuware-topaz-for-total-test-plugin",
@@ -573,20 +391,6 @@
"license_spdx": "MIT",
"origin": "osv"
},
{
"repository": "opensearch-project/reporting",
"repo": "opensearch-project/reporting",
"url": "https://github.com/opensearch-project/reporting.git",
"fix": "2403014c57ee63268e83d919db3334b676a8c992",
"parent": "e54a3eab2c463d2e9eb722fdc0fcec5c78c31864",
"family": "access_control",
"cwe": "CWE-639",
"advisory": "GHSA-xmvg-335g-x44q",
"advisory_text": "The OpenSearch reporting plugin improperly controls tenancy access to reporting resources\n\n### Summary\n\nAn issue in the OpenSearch reporting plugin allows unintended access to private tenant resources like notebooks. The system did not properly check if the user was the resource author when accessing resources in a private tenant, leading to potential data being revealed.\n\n### Impact\n\nThe lack of proper access control validation for private tenant resources in the OpenSearch observability and reporting plugins can lead to unintended data access. If an authorized user with observability or reporting roles is aware of another user's private tenant resource ID, such as a notebook, they can potentially read, modify, or take ownership of that resource, despite not being the original author, thus impacting the confidentiality and integrity of private tenant resources. The impact is confined to private tenant resources, where authorized users may gain inappropriate visibility into data intended to be private from other users within the same OpenSearch instance, potentially violating the intended separation of access. This issue does not alter the scope of access but highlights a flaw in the existing access control mechanisms.\n\nImpacted versions <= 2.13\n\n### Patches\n\nThe patches are included in OpenSearch 2.14\n\n### Workarounds\n\nNone\n\n### References\n\nOpenSearch 2.14 is available for download at https://opensearch.org/versions/opensearch-2-14-0.html\n\nThe latest version of OpenSearch is available for download at https://opensearch.org/downloads.html",
"ecosystem": "maven",
"license_spdx": "Apache-2.0",
"origin": "osv"
},
{
"repository": "apache/ozone",
"repo": "apache/ozone",
@@ -615,20 +419,6 @@
"license_spdx": "MIT",
"origin": "osv"
},
{
"repository": "phpvms/phpvms",
"repo": "phpvms/phpvms",
"url": "https://github.com/phpvms/phpvms.git",
"fix": "f59ba8e0e8fc25c60c3faf14e526cfd49df3f7dc",
"parent": "61118a5802a26b358fadaeb1fb2a95fcfb93ae38",
"family": "access_control",
"cwe": "CWE-284",
"advisory": "GHSA-fv26-4939-62fh",
"advisory_text": "phpVMS has an /importer authorization bypass causing full database wipe\n\n# Security Advisory: Unauthenticated Access to Legacy Import Feature\n\n**Severity:** Critical\n**Affected versions:** phpVMS 7.x (up to 7.0.5)\n**Fixed in:** v7.0.6\n**Component:** Legacy importer\n\n## Summary\n\nA critical vulnerability in phpVMS 7.x allowed unauthenticated access to a legacy import feature. Although this feature is deprecated, parts of it remained accessible and operational.\n\n## Impact\n\nA remote attacker could trigger internal processes that modify or delete application data, potentially resulting in:\n\n- Data loss\n- Service disruption\n\nNo authentication was required.\n\n## Remediation\n\n- **Update immediately** to [the latest patched version](https://github.com/phpvms/phpvms/releases/tag/7.0.7)\n- If unable to update:\n - The release link has instructions on how to fix it (it's a one-line fix to comment out the routes)\n\n## Affected Versions\n\n* Affected: phpVMS 7.x ≤ 7.0.5\n* Not affected: phpVMS >= 7.0.6, v8 (feature removed from public access)",
"ecosystem": "composer",
"license_spdx": "BSD-3-Clause",
"origin": "osv"
},
{
"repository": "apache/seatunnel",
"repo": "apache/seatunnel",
@@ -657,20 +447,6 @@
"license_spdx": "Apache-2.0",
"origin": "osv"
},
{
"repository": "shopware/core",
"repo": "shopware/core",
"url": "https://github.com/shopware/core.git",
"fix": "329e4d7e028dd8081496cf8bd3acc822000b0ec0",
"parent": "2c23a54172c6323bbfef4054d615a131d80fd296",
"family": "access_control",
"cwe": "CWE-863",
"advisory": "GHSA-83vp-6jqg-6cmr",
"advisory_text": "Incorrect Authentication in shopware\n\n### Impact\nModify Customers, create Orders without App Permission\n\n## Patches\nWe recommend updating to the current version 6.4.8.2. You can get the update to 6.4.8.2 regularly via the Auto-Updater or directly via the download overview.\n\nhttps://www.shopware.com/en/download/#shopware-6\n\n## Workarounds\nFor older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.",
"ecosystem": "composer",
"license_spdx": "MIT",
"origin": "osv"
},
{
"repository": "jenkinsci/android-signing-plugin",
"repo": "jenkinsci/android-signing-plugin",
@@ -741,34 +517,6 @@
"license_spdx": "MIT",
"origin": "osv"
},
{
"repository": "smallrye/smallrye-config",
"repo": "smallrye/smallrye-config",
"url": "https://github.com/smallrye/smallrye-config.git",
"fix": "fb0def6f61c09a2a80c9145e4ec6521225cd0b99",
"parent": "4e7ea864c0e3fb32f1f74554133de86032977807",
"family": "access_control",
"cwe": "CWE-863",
"advisory": "GHSA-54fx-gm74-q676",
"advisory_text": "Permissions bypass in SmallRye\n\nA flaw was found in SmallRye's API through version 1.6.1. The API can allow other code running within the application server to potentially obtain the ClassLoader, bypassing any permissions checks that should have been applied. The largest threat from this vulnerability is a threat to data confidentiality. This is fixed in SmallRye 1.6.2",
"ecosystem": "maven",
"license_spdx": "Apache-2.0",
"origin": "osv"
},
{
"repository": "qos-ch/slf4j",
"repo": "qos-ch/slf4j",
"url": "https://github.com/qos-ch/slf4j.git",
"fix": "d2b27fba88e983f921558da27fc29b5f5d269405",
"parent": "0ec1f6aac8648e87a7dda2f5730fef6db3b4fa33",
"family": "access_control",
"cwe": "CWE-284",
"advisory": "GHSA-w77p-8cfg-2x43",
"advisory_text": "Improper Access Control in SLF4J\n\norg.slf4j.ext.EventData in the slf4j-ext module in QOS.CH SLF4J before `1.8.0-beta4` allows remote attackers to bypass intended access restrictions via crafted data. EventData in the slf4j-ext module in QOS.CH SLF4J, has been fixed in SLF4J version `1.7.26` and later and in the `2.0.x` series.\n\nNote that while the [fix commit](https://github.com/qos-ch/slf4j/commit/d2b27fba88e983f921558da27fc29b5f5d269405) is associated with the tag `1.8.0-beta3`, the versions in [Maven](https://mvnrepository.com/artifact/org.slf4j/slf4j-ext) go directly from `1.8.0-beta2` to `1.8.0-beta4`.",
"ecosystem": "maven",
"license_spdx": "MIT",
"origin": "osv"
},
{
"repository": "apache/kafka",
"repo": "apache/kafka",
@@ -783,20 +531,6 @@
"license_spdx": "Apache-2.0",
"origin": "osv"
},
{
"repository": "opensearch-project/observability",
"repo": "opensearch-project/observability",
"url": "https://github.com/opensearch-project/observability.git",
"fix": "014423178f8f61d90442dde03cbdcd754c70a84e",
"parent": "162e81a61874c08a3a8ded1d0e39b6aa77390748",
"family": "access_control",
"cwe": "CWE-285",
"advisory": "GHSA-77vc-rj32-2r33",
"advisory_text": "OpenSearch Observability does not properly restrict access to private tenant resources\n\n### Summary\n\nAn issue in the OpenSearch observability plugins allows unintended access to private tenant resources like notebooks. The system did not properly check if the user was the resource author when accessing resources in a private tenant, leading to potential data being revealed.\n\n### Impact\n\nThe lack of proper access control validation for private tenant resources in the OpenSearch observability and reporting plugins can lead to unintended data access. If an authorized user with observability or reporting roles is aware of another user's private tenant resource ID, such as a notebook, they can potentially read, modify, or take ownership of that resource, despite not being the original author, thus impacting the confidentiality and integrity of private tenant resources. The impact is confined to private tenant resources, where authorized users may gain inappropriate visibility into data intended to be private from other users within the same OpenSearch instance, potentially violating the intended separation of access. This issue does not alter the scope of access but highlights a flaw in the existing access control mechanisms.\n\nImpacted versions <= 2.13\n\n### Patches\n\nThe patches are included in OpenSearch 2.14\n\n### Workarounds\n\nNone\n\n### References\n\nOpenSearch 2.14 is available for download at https://opensearch.org/versions/opensearch-2-14-0.html\n\nThe latest version of OpenSearch is available for download at https://opensearch.org/downloads.html",
"ecosystem": "maven",
"license_spdx": "Apache-2.0",
"origin": "osv"
},
{
"repository": "jenkinsci/jiratestresultreporter-plugin",
"repo": "jenkinsci/jiratestresultreporter-plugin",
@@ -895,20 +629,6 @@
"license_spdx": "Apache-2.0",
"origin": "osv"
},
{
"repository": "stevespringett/alpine",
"repo": "stevespringett/alpine",
"url": "https://github.com/stevespringett/Alpine.git",
"fix": "a7432184b9137ea095799a77f9ced370553acbd7",
"parent": "142876cecbbf4a0169f397651c83c96d0d9b459b",
"family": "access_control",
"cwe": "CWE-863",
"advisory": "GHSA-2w4p-2hf7-gh8x",
"advisory_text": "Alpine allows URL access filter bypass\n\nAlpine is a scaffolding library in Java. Alpine prior to version 1.10.4 allows URL access filter bypass. This issue has been fixed in version 1.10.4. There are no known workarounds.",
"ecosystem": "maven",
"license_spdx": "Apache-2.0",
"origin": "osv"
},
{
"repository": "jenkinsci/global-build-stats-plugin",
"repo": "jenkinsci/global-build-stats-plugin",
@@ -1049,20 +769,6 @@
"license_spdx": "MIT",
"origin": "osv"
},
{
"repository": "spring-cloud/spring-cloud-netflix",
"repo": "spring-cloud/spring-cloud-netflix",
"url": "https://github.com/spring-cloud/spring-cloud-netflix.git",
"fix": "8ecb3dca511c3ce0454e42ac31ee2331d7318c07",
"parent": "df64a02013c11156835a9f795078c69323dd0271",
"family": "access_control",
"cwe": "CWE-863",
"advisory": "GHSA-vwpg-f6gw-rjvf",
"advisory_text": "Incorrect Authorization in Spring Cloud Netflix Zuul\n\nApplications using the “Sensitive Headers” functionality in Spring Cloud Netflix Zuul 2.2.6.RELEASE and below may be vulnerable to bypassing the “Sensitive Headers” restriction when executing requests with specially constructed URLs. Applications that use Spring Security's StrictHttpFirewall (enabled by default for all URLs) are not affected by the vulnerability, as they reject requests that allow bypassing.",
"ecosystem": "maven",
"license_spdx": "Apache-2.0",
"origin": "osv"
},
{
"repository": "jenkinsci/ec2-plugin",
"repo": "jenkinsci/ec2-plugin",
benchmarks/valid/train/sources_access_control_dropped.json
+317
View File
@@ -0,0 +1,317 @@
[
{
"repository": "payloadcms/payload",
"repo": "payloadcms/payload",
"url": "https://github.com/payloadcms/payload.git",
"fix": "19b58692d20d3947f31124bf7a88ac14a5ebf02e",
"parent": "b8fc06a18afb6974dc07f95ac1e541c716e5926b",
"family": "access_control",
"cwe": "CWE-862",
"advisory": "GHSA-p96c-xwx8-3cqj",
"advisory_text": "Payload has a tenant authorization bypass in Multi-Tenant Plugin\n\n## Impact\n\nWhen using the default tenant array field access, an authenticated user could assign themselves to other tenants.\n\n**You are affected if:**\n\n- You are using `@payloadcms/plugin-multi-tenant`\n\nIf you configure the tenants arrayFieldAccess.create/update functions, a secured replacement membership field, you are not affected by this specific default behavior.\n\n## Patches\n\nUsers should upgrade Payload packages to `>= 3.90.0` or `>= 4.0.0-canary.34`.\n\n## Workarounds\n\nConfigure tenants arrayFieldAccess.create and tenants arrayFieldAccess.update so only trusted users authorized for all tenants can modify memberships.",
"ecosystem": "npm",
"license_spdx": "MIT",
"origin": "osv",
"clone_status": "not_cloned"
},
{
"repository": "unshiftio/url-parse",
"repo": "unshiftio/url-parse",
"url": "https://github.com/unshiftio/url-parse.git",
"fix": "0e3fb542d60ddbf6933f22eb9b1e06e25eaa5b63",
"parent": "61864a8eccff714a45d23db85a814e3c6ee0baba",
"family": "access_control",
"cwe": "CWE-639",
"advisory": "GHSA-jf5r-8hm2-f872",
"advisory_text": "url-parse incorrectly parses hostname / protocol due to unstripped leading control characters.\n\nLeading control characters in a URL are not stripped when passed into url-parse. This can cause input URLs to be mistakenly be interpreted as a relative URL without a hostname and protocol, while the WHATWG URL parser will trim control characters and treat it as an absolute URL.\n\nIf url-parse is used in security decisions involving the hostname / protocol, and the input URL is used in a client which uses the WHATWG URL parser, the decision may be incorrect.\n\nThis can also lead to a cross-site scripting (XSS) vulnerability if url-parse is used to check for the javascript: protocol in URLs. See following example:\n```js\nconst parse = require('url-parse')\nconst express = require('express')\nconst app = express()\nconst port = 3000\n\nurl = parse(\\\"\\\\bjavascript:alert(1)\\\")\n\nconsole.log(url)\n\napp.get('/', (req, res) => {\n if (url.protocol !== \\\"javascript:\\\") {res.send(\\\"<a href=\\\\'\\\" + url.href + \\\"\\\\'>CLICK ME!</a>\\\")}\n })\n\napp.listen(port, () => {\n console.log(`Example app listening on port ${port}`)\n })\n```",
"ecosystem": "npm",
"license_spdx": "MIT",
"origin": "osv",
"clone_status": "not_cloned"
},
{
"repository": "yonle/bostr",
"repo": "yonle/bostr",
"url": "https://github.com/Yonle/bostr.git",
"fix": "49181f4ec9ae1472c6675cab56bbc01e723855af",
"parent": "8b131e239b92db889ac5d8fd02bee1d3a035fd9d",
"family": "access_control",
"cwe": "CWE-285",
"advisory": "GHSA-5cf7-cxrf-mq73",
"advisory_text": "Bostr Improper Authorization vulnerability\n\nEven with `authorized_keys` is filled with allowed pubkeys, If `noscraper` is enabled, It will allow anyone to use bouncer even it's pubkey is not in `authorized_keys`.\n\n### Impact\n- Private bouncer\n\n### Patches\nAvailable on version [3.0.10](https://github.com/Yonle/bostr/releases/tag/3.0.10)\n\n### Workarounds\nDisable `noscraper` if you have `authorized_keys` being set in config\n\n### References\nThis [line of code](https://github.com/Yonle/bostr/blob/8665374a66e2afb9f92d0414b0d6f420a95d5d2d/auth.js#L21) is the cause.",
"ecosystem": "npm",
"license_spdx": "BSD-3-Clause",
"origin": "osv",
"clone_status": "not_cloned"
},
{
"repository": "scrapy/scrapy",
"repo": "scrapy/scrapy",
"url": "https://github.com/scrapy/scrapy.git",
"fix": "8ce01b3b76d4634f55067d6cfdf632ec70ba304a",
"parent": "aa0306a167ef34b23cc2ec407a48359a4b5a8d0a",
"family": "access_control",
"cwe": "CWE-863",
"advisory": "GHSA-cjvr-mfj7-j4j8",
"advisory_text": "Incorrect Authorization and Exposure of Sensitive Information to an Unauthorized Actor in scrapy\n\n### Impact\n\nIf you manually define cookies on a [`Request`](https://docs.scrapy.org/en/latest/topics/request-response.html#scrapy.http.Request) object, and that `Request` object gets a redirect response, the new `Request` object scheduled to follow the redirect keeps those user-defined cookies, regardless of the target domain.\n\n### Patches\n\nUpgrade to Scrapy 2.6.0, which resets cookies when creating `Request` objects to follow redirects¹, and drops the ``Cookie`` header if manually-defined if the redirect target URL domain name does not match the source URL domain name².\n\nIf you are using Scrapy 1.8 or a lower version, and upgrading to Scrapy 2.6.0 is not an option, you may upgrade to Scrapy 1.8.2 instead.\n\n¹ At that point the original, user-set cookies have been processed by the cookie middleware into the global or request-specific cookiejar, with their domain restricted to the domain of the original URL, so when the cookie middleware processes the new (redirect) request it will incorporate those cookies into the new request as long as the domain of the new request matches the domain of the original request.\n\n² This prevents cookie leaks to unintended domains even if the cookies middleware is not used.\n\n### Workarounds\n\nIf you cannot upgrade, set your cookies using a list of dictionaries instead of a single dictionary, as described in the [`Request` documentation](https://docs.scrapy.org/en/latest/topics/request-response.html#scrapy.http.Request), and set the right domain for each cookie.\n\nAlternatively, you can [disable cookies altogether](https://docs.scrapy.org/en/latest/topics/downloader-middleware.html#std-setting-COOKIES_ENABLED), or [limit target domains](https://docs.scrapy.org/en/latest/topics/spiders.html#scrapy.spiders.Spider.allowed_domains) to domains that you trust with all your user-set cookies.\n\n### References\n* Originally reported at [huntr.dev](https://huntr.dev/bounties/3da527b1-2348-4f69-9e88-2e11a96ac585/)\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n* [Open an issue](https://github.com/scrapy/scrapy/issues)\n* [Email us](mailto:[email protected])",
"ecosystem": "pip",
"license_spdx": "BSD-3-Clause",
"origin": "osv",
"clone_status": "not_cloned"
},
{
"repository": "openzeppelin/cairo-contracts",
"repo": "openzeppelin/cairo-contracts",
"url": "https://github.com/OpenZeppelin/cairo-contracts.git",
"fix": "2cd60279c3332285d47edf9ee3888b71257acdc9",
"parent": "f7d319fb19b9afe868034283d66062ae83da649a",
"family": "access_control",
"cwe": "CWE-863",
"advisory": "GHSA-8mjr-jr5h-q2xr",
"advisory_text": "OpenZeppelin Contracts for Cairo account cannot process transactions on Goerli\n\n### Impact\nThis vulnerability affects all accounts (vanilla and ethereum flavors) in the [v0.2.0 release of OpenZeppelin Contracts for Cairo](https://github.com/OpenZeppelin/cairo-contracts/releases/tag/v0.2.0), which are not whitelisted on StarkNet mainnet, so only goerli deployments of v0.2.0 accounts are affected.\n\nThis faulty behavior is not observed in [StarkNet's testing framework](https://github.com/starkware-libs/cairo-lang/blob/master/src/starkware/starknet/testing/starknet.py), so don't rely on it passing to detect this issue on custom accounts.\n\n### Patches\nThis bug has been patched in [v0.2.1](https://github.com/OpenZeppelin/cairo-contracts/releases/tag/v0.2.1).\n\n### References\nThe issue is detailed in https://github.com/OpenZeppelin/cairo-contracts/issues/386.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [the Contracts for Cairo repo](https://github.com/OpenZeppelin/cairo-contracts/issues/new/choose)\n* Email us at [[email protected]](mailto:[email protected])",
"ecosystem": "pip",
"license_spdx": "MIT",
"origin": "osv",
"clone_status": "not_cloned"
},
{
"repository": "mercurius-js/mercurius",
"repo": "mercurius-js/mercurius",
"url": "https://github.com/mercurius-js/mercurius.git",
"fix": "5b56f60f4b0d60780b0ff499a479bd830bdd6986",
"parent": "249809aed8c6bcb98c1d53404c6896b32e1f29e1",
"family": "access_control",
"cwe": "CWE-863",
"advisory": "GHSA-m4h2-mjfm-mp55",
"advisory_text": "Mercurius's queryDepth limit bypassed for WebSocket subscriptions\n\n## Description\n\nMercurius fails to enforce the configured queryDepth limit on GraphQL subscription queries received over WebSocket connections. The depth check is correctly applied to HTTP queries and mutations, but subscription queries are parsed and executed without invoking the depth validation. This allows a remote client to submit arbitrarily deeply nested subscription queries over WebSocket, bypassing the intended depth restriction. On schemas with recursive types, this can lead to denial of service through exponential data resolution on each subscription event.\n\n## Workarounds\n\nDisable subscriptions and, in general, queries over the WebSocket.",
"ecosystem": "npm",
"license_spdx": "MIT",
"origin": "osv",
"clone_status": "not_cloned"
},
{
"repository": "web-auth/webauthn-framework",
"repo": "web-auth/webauthn-framework",
"url": "https://github.com/web-auth/webauthn-framework.git",
"fix": "572e239c5702667ca52487faf861abc768a46308",
"parent": "de5cd2451e74220708ba5ac891a3c97ce87e7011",
"family": "access_control",
"cwe": "CWE-863",
"advisory": "GHSA-6whf-q6p5-84wg",
"advisory_text": "Improper Access Control in Webauthn Framework\n\nWebauthn Framework 3.3.x before 3.3.4 has Incorrect Access Control. An attacker that controls a user's system is able to login to a vulnerable service using an attached FIDO2 authenticator without passing a check of the user presence.",
"ecosystem": "composer",
"license_spdx": "MIT",
"origin": "osv",
"clone_status": "not_cloned"
},
{
"repository": "medialize/uri.js",
"repo": "medialize/uri.js",
"url": "https://github.com/medialize/URI.js.git",
"fix": "6ea641cc8648b025ed5f30b090c2abd4d1a5249f",
"parent": "19e54c78d5864aec43986e8f96be8d15998daa80",
"family": "access_control",
"cwe": "CWE-639",
"advisory": "GHSA-gcv8-gh4r-25x6",
"advisory_text": "Authorization Bypass Through User-Controlled Key in urijs\n\nAttacker can use case-insensitive protocol schemes like HTTP, htTP, HTtp etc. in order to bypass the patch for CVE-2021-3647.",
"ecosystem": "npm",
"license_spdx": "MIT",
"origin": "osv",
"clone_status": "not_cloned"
},
{
"repository": "thinkst/opencanary",
"repo": "thinkst/opencanary",
"url": "https://github.com/thinkst/opencanary.git",
"fix": "2c11575b1a3dd8b0df26a879ba856c0aa350c049",
"parent": "d3956bc602f95d2bec55eebc96d5e3a2cb35bf47",
"family": "access_control",
"cwe": "CWE-863",
"advisory": "GHSA-pf5v-pqfv-x8jj",
"advisory_text": "OpenCanary Executes Commands From Potentially Writable Config File\n\n### Impact\n\nOpenCanary directly executed commands taken from its config file. Where the config file is stored in an unprivileged user directory but the daemon is executed by root, it’s possible for the unprivileged user to change the config file and escalate permissions when root later runs the daemon.\n\nThanks to the folks at [Whirlylabs](https://whirlylabs.com/) for finding and fixing this.\n\n### Patches\n\nUpgrade to 0.9.4 or higher.",
"ecosystem": "pip",
"license_spdx": "BSD-3-Clause",
"origin": "osv",
"clone_status": "not_cloned"
},
{
"repository": "openstack/barbican",
"repo": "openstack/barbican",
"url": "https://github.com/openstack/barbican.git",
"fix": "7d270bacbe29a90a10f1855abc3b50dac0f08022",
"parent": "8bd16953ebb11c38c02151687967ee93c88067d7",
"family": "access_control",
"cwe": "CWE-863",
"advisory": "GHSA-p2jg-q8hw-p7gc",
"advisory_text": "Barbican authorization flaw before v14.0.0\n\nAn authorization flaw was found in openstack-barbican. The default policy rules for the secret metadata API allowed any authenticated user to add, modify, or delete metadata from any secret regardless of ownership. This flaw allows an attacker on the network to modify or delete protected data, causing a denial of service by consuming protected resources.",
"ecosystem": "pip",
"license_spdx": "Apache-2.0",
"origin": "osv",
"clone_status": "not_cloned"
},
{
"repository": "parisneo/lollms",
"repo": "parisneo/lollms",
"url": "https://github.com/ParisNeo/lollms.git",
"fix": "a3b2b82b84d537a9da63e63a370a6a8ad55fed34",
"parent": "a2f10ca90129cd8a3a01474562d50d3089eb8c85",
"family": "access_control",
"cwe": "CWE-284",
"advisory": "GHSA-9296-v3fr-j92j",
"advisory_text": "LoLLMs is vulnerable to Improper Access Control through weak secret key\n\nIn parisneo/lollms version 2.1.0, the application's session management is vulnerable to improper access control due to the use of a weak secret key for signing JSON Web Tokens (JWT). This vulnerability allows an attacker to perform an offline brute-force attack to recover the secret key. Once the secret key is obtained, the attacker can forge administrative tokens by modifying the JWT payload and resigning it with the cracked secret. This enables unauthorized users to escalate privileges, impersonate the administrator, and gain access to restricted endpoints. The issue is resolved in version 2.2.0.",
"ecosystem": "pip",
"license_spdx": "Apache-2.0",
"origin": "osv",
"clone_status": "not_cloned"
},
{
"repository": "tomasvotava/fastapi-sso",
"repo": "tomasvotava/fastapi-sso",
"url": "https://github.com/tomasvotava/fastapi-sso.git",
"fix": "6117d1a5ad498ba57d671e8a059ebe20db5abe02",
"parent": "da63c19bca7db0fe8a7e66d03fdf07154ec7182a",
"family": "access_control",
"cwe": "CWE-285",
"advisory": "GHSA-hp6r-r9vc-q8wx",
"advisory_text": "FastAPI SSP is vulnerable to Cross-site Request Forgery (CSRF) through improper OAuth parameter validation\n\nVersions of the package fastapi-sso before 0.19.0 are vulnerable to Cross-site Request Forgery (CSRF) due to the improper validation of the OAuth state parameter during the authentication callback. While the get_login_url method allows for state generation, it does not persist the state or bind it to the user's session. Consequently, the verify_and_process method accepts the state received in the query parameters without verifying it against a trusted local value. This allows a remote attacker to trick a victim into visiting a malicious callback URL, which can result in the attacker's account being linked to the victim's internal account.",
"ecosystem": "pip",
"license_spdx": "MIT",
"origin": "osv",
"clone_status": "not_cloned"
},
{
"repository": "neuron-core/neuron-ai",
"repo": "neuron-core/neuron-ai",
"url": "https://github.com/neuron-core/neuron-ai.git",
"fix": "44bab85d92bf162898ee48d0bcef6ba0d29b59c9",
"parent": "72735d0ea133266cf2f5d5d195d41e9dd865289a",
"family": "access_control",
"cwe": "CWE-284",
"advisory": "GHSA-898v-775g-777c",
"advisory_text": "Neuron MySQLWriteTool allows arbitrary/destructive SQL when exposed to untrusted prompts (agent “footgun”)\n\n### Impact\n\n`MySQLWriteTool` executes arbitrary SQL provided by the caller using `PDO::prepare()` + `execute()` without semantic restrictions. \n\nThis is consistent with the name (“write tool”), but in an LLM/agent context it becomes a high-risk capability: prompt injection or indirect prompt manipulation can cause execution of destructive queries such as `DROP TABLE`, `TRUNCATE`, `DELETE`, `ALTER`, or privilege-related statements (subject to DB permissions).\n\n\n\n**Who is impacted:** Deployments that expose an agent with `MySQLWriteTool` enabled to untrusted input and/or run the tool with a DB user that has broad privileges.\n\n### Patches\n\n**Not patched in:** 2.8.11 \n\nRecommended improvements (even if keeping the tool intentionally powerful):\n\n- Provide a safer API that supports only constrained operations (e.g., `insertRecord`, `updateRecord`) with allowlisted tables/columns.\n\n- Add a policy/allowlist layer (e.g., allow only `INSERT`/`UPDATE` on selected tables; forbid `DROP/TRUNCATE/ALTER/GRANT`).\n\n- Add optional review workflow: log + require human approval for high-risk statements; or “dry-run” mode.\n\n- Document strongly that the tool must not be exposed to untrusted prompts without additional safeguards.\n\n\n\n### Workarounds\n\n- Do not enable `MySQLWriteTool` for public/untrusted agents.\n\n- Use a dedicated DB user with **least privilege**:\n\n - no `DROP`, no `ALTER`, no `GRANT`, no access to sensitive tables unless necessary\n\n- Add an application-layer policy rejecting high-risk statements (`DROP`, `TRUNCATE`, `ALTER`, `GRANT`, `REVOKE`, `CREATE USER`, etc.).\n\n- Implement authorization gating for tool calls (RBAC, allow tool use only for trusted operators).",
"ecosystem": "composer",
"license_spdx": "MIT",
"origin": "osv",
"clone_status": "not_cloned"
},
{
"repository": "opensearch-project/reporting",
"repo": "opensearch-project/reporting",
"url": "https://github.com/opensearch-project/reporting.git",
"fix": "2403014c57ee63268e83d919db3334b676a8c992",
"parent": "e54a3eab2c463d2e9eb722fdc0fcec5c78c31864",
"family": "access_control",
"cwe": "CWE-639",
"advisory": "GHSA-xmvg-335g-x44q",
"advisory_text": "The OpenSearch reporting plugin improperly controls tenancy access to reporting resources\n\n### Summary\n\nAn issue in the OpenSearch reporting plugin allows unintended access to private tenant resources like notebooks. The system did not properly check if the user was the resource author when accessing resources in a private tenant, leading to potential data being revealed.\n\n### Impact\n\nThe lack of proper access control validation for private tenant resources in the OpenSearch observability and reporting plugins can lead to unintended data access. If an authorized user with observability or reporting roles is aware of another user's private tenant resource ID, such as a notebook, they can potentially read, modify, or take ownership of that resource, despite not being the original author, thus impacting the confidentiality and integrity of private tenant resources. The impact is confined to private tenant resources, where authorized users may gain inappropriate visibility into data intended to be private from other users within the same OpenSearch instance, potentially violating the intended separation of access. This issue does not alter the scope of access but highlights a flaw in the existing access control mechanisms.\n\nImpacted versions <= 2.13\n\n### Patches\n\nThe patches are included in OpenSearch 2.14\n\n### Workarounds\n\nNone\n\n### References\n\nOpenSearch 2.14 is available for download at https://opensearch.org/versions/opensearch-2-14-0.html\n\nThe latest version of OpenSearch is available for download at https://opensearch.org/downloads.html",
"ecosystem": "maven",
"license_spdx": "Apache-2.0",
"origin": "osv",
"clone_status": "not_cloned"
},
{
"repository": "phpvms/phpvms",
"repo": "phpvms/phpvms",
"url": "https://github.com/phpvms/phpvms.git",
"fix": "f59ba8e0e8fc25c60c3faf14e526cfd49df3f7dc",
"parent": "61118a5802a26b358fadaeb1fb2a95fcfb93ae38",
"family": "access_control",
"cwe": "CWE-284",
"advisory": "GHSA-fv26-4939-62fh",
"advisory_text": "phpVMS has an /importer authorization bypass causing full database wipe\n\n# Security Advisory: Unauthenticated Access to Legacy Import Feature\n\n**Severity:** Critical\n**Affected versions:** phpVMS 7.x (up to 7.0.5)\n**Fixed in:** v7.0.6\n**Component:** Legacy importer\n\n## Summary\n\nA critical vulnerability in phpVMS 7.x allowed unauthenticated access to a legacy import feature. Although this feature is deprecated, parts of it remained accessible and operational.\n\n## Impact\n\nA remote attacker could trigger internal processes that modify or delete application data, potentially resulting in:\n\n- Data loss\n- Service disruption\n\nNo authentication was required.\n\n## Remediation\n\n- **Update immediately** to [the latest patched version](https://github.com/phpvms/phpvms/releases/tag/7.0.7)\n- If unable to update:\n - The release link has instructions on how to fix it (it's a one-line fix to comment out the routes)\n\n## Affected Versions\n\n* Affected: phpVMS 7.x ≤ 7.0.5\n* Not affected: phpVMS >= 7.0.6, v8 (feature removed from public access)",
"ecosystem": "composer",
"license_spdx": "BSD-3-Clause",
"origin": "osv",
"clone_status": "not_cloned"
},
{
"repository": "shopware/core",
"repo": "shopware/core",
"url": "https://github.com/shopware/core.git",
"fix": "329e4d7e028dd8081496cf8bd3acc822000b0ec0",
"parent": "2c23a54172c6323bbfef4054d615a131d80fd296",
"family": "access_control",
"cwe": "CWE-863",
"advisory": "GHSA-83vp-6jqg-6cmr",
"advisory_text": "Incorrect Authentication in shopware\n\n### Impact\nModify Customers, create Orders without App Permission\n\n## Patches\nWe recommend updating to the current version 6.4.8.2. You can get the update to 6.4.8.2 regularly via the Auto-Updater or directly via the download overview.\n\nhttps://www.shopware.com/en/download/#shopware-6\n\n## Workarounds\nFor older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.",
"ecosystem": "composer",
"license_spdx": "MIT",
"origin": "osv",
"clone_status": "not_cloned"
},
{
"repository": "smallrye/smallrye-config",
"repo": "smallrye/smallrye-config",
"url": "https://github.com/smallrye/smallrye-config.git",
"fix": "fb0def6f61c09a2a80c9145e4ec6521225cd0b99",
"parent": "4e7ea864c0e3fb32f1f74554133de86032977807",
"family": "access_control",
"cwe": "CWE-863",
"advisory": "GHSA-54fx-gm74-q676",
"advisory_text": "Permissions bypass in SmallRye\n\nA flaw was found in SmallRye's API through version 1.6.1. The API can allow other code running within the application server to potentially obtain the ClassLoader, bypassing any permissions checks that should have been applied. The largest threat from this vulnerability is a threat to data confidentiality. This is fixed in SmallRye 1.6.2",
"ecosystem": "maven",
"license_spdx": "Apache-2.0",
"origin": "osv",
"clone_status": "not_cloned"
},
{
"repository": "qos-ch/slf4j",
"repo": "qos-ch/slf4j",
"url": "https://github.com/qos-ch/slf4j.git",
"fix": "d2b27fba88e983f921558da27fc29b5f5d269405",
"parent": "0ec1f6aac8648e87a7dda2f5730fef6db3b4fa33",
"family": "access_control",
"cwe": "CWE-284",
"advisory": "GHSA-w77p-8cfg-2x43",
"advisory_text": "Improper Access Control in SLF4J\n\norg.slf4j.ext.EventData in the slf4j-ext module in QOS.CH SLF4J before `1.8.0-beta4` allows remote attackers to bypass intended access restrictions via crafted data. EventData in the slf4j-ext module in QOS.CH SLF4J, has been fixed in SLF4J version `1.7.26` and later and in the `2.0.x` series.\n\nNote that while the [fix commit](https://github.com/qos-ch/slf4j/commit/d2b27fba88e983f921558da27fc29b5f5d269405) is associated with the tag `1.8.0-beta3`, the versions in [Maven](https://mvnrepository.com/artifact/org.slf4j/slf4j-ext) go directly from `1.8.0-beta2` to `1.8.0-beta4`.",
"ecosystem": "maven",
"license_spdx": "MIT",
"origin": "osv",
"clone_status": "not_cloned"
},
{
"repository": "opensearch-project/observability",
"repo": "opensearch-project/observability",
"url": "https://github.com/opensearch-project/observability.git",
"fix": "014423178f8f61d90442dde03cbdcd754c70a84e",
"parent": "162e81a61874c08a3a8ded1d0e39b6aa77390748",
"family": "access_control",
"cwe": "CWE-285",
"advisory": "GHSA-77vc-rj32-2r33",
"advisory_text": "OpenSearch Observability does not properly restrict access to private tenant resources\n\n### Summary\n\nAn issue in the OpenSearch observability plugins allows unintended access to private tenant resources like notebooks. The system did not properly check if the user was the resource author when accessing resources in a private tenant, leading to potential data being revealed.\n\n### Impact\n\nThe lack of proper access control validation for private tenant resources in the OpenSearch observability and reporting plugins can lead to unintended data access. If an authorized user with observability or reporting roles is aware of another user's private tenant resource ID, such as a notebook, they can potentially read, modify, or take ownership of that resource, despite not being the original author, thus impacting the confidentiality and integrity of private tenant resources. The impact is confined to private tenant resources, where authorized users may gain inappropriate visibility into data intended to be private from other users within the same OpenSearch instance, potentially violating the intended separation of access. This issue does not alter the scope of access but highlights a flaw in the existing access control mechanisms.\n\nImpacted versions <= 2.13\n\n### Patches\n\nThe patches are included in OpenSearch 2.14\n\n### Workarounds\n\nNone\n\n### References\n\nOpenSearch 2.14 is available for download at https://opensearch.org/versions/opensearch-2-14-0.html\n\nThe latest version of OpenSearch is available for download at https://opensearch.org/downloads.html",
"ecosystem": "maven",
"license_spdx": "Apache-2.0",
"origin": "osv",
"clone_status": "not_cloned"
},
{
"repository": "stevespringett/alpine",
"repo": "stevespringett/alpine",
"url": "https://github.com/stevespringett/Alpine.git",
"fix": "a7432184b9137ea095799a77f9ced370553acbd7",
"parent": "142876cecbbf4a0169f397651c83c96d0d9b459b",
"family": "access_control",
"cwe": "CWE-863",
"advisory": "GHSA-2w4p-2hf7-gh8x",
"advisory_text": "Alpine allows URL access filter bypass\n\nAlpine is a scaffolding library in Java. Alpine prior to version 1.10.4 allows URL access filter bypass. This issue has been fixed in version 1.10.4. There are no known workarounds.",
"ecosystem": "maven",
"license_spdx": "Apache-2.0",
"origin": "osv",
"clone_status": "not_cloned"
},
{
"repository": "spring-cloud/spring-cloud-netflix",
"repo": "spring-cloud/spring-cloud-netflix",
"url": "https://github.com/spring-cloud/spring-cloud-netflix.git",
"fix": "8ecb3dca511c3ce0454e42ac31ee2331d7318c07",
"parent": "df64a02013c11156835a9f795078c69323dd0271",
"family": "access_control",
"cwe": "CWE-863",
"advisory": "GHSA-vwpg-f6gw-rjvf",
"advisory_text": "Incorrect Authorization in Spring Cloud Netflix Zuul\n\nApplications using the “Sensitive Headers” functionality in Spring Cloud Netflix Zuul 2.2.6.RELEASE and below may be vulnerable to bypassing the “Sensitive Headers” restriction when executing requests with specially constructed URLs. Applications that use Spring Security's StrictHttpFirewall (enabled by default for all URLs) are not affected by the vulnerability, as they reject requests that allow bypassing.",
"ecosystem": "maven",
"license_spdx": "Apache-2.0",
"origin": "osv",
"clone_status": "not_cloned"
}
]
benchmarks/valid/train/verification_access_control.json
+1780
View File
File diff suppressed because it is too large Load Diff