CVE-2023-39438

A missing authorization check allows an arbitrary authenticated user to perform certain operations through the API of CLA-assistant by executing specific additional steps. This allows an arbitrary authenticated user to read CLA information including information of the persons who signed them as well as custom fields the CLA requester had configured. In addition, an arbitrary authenticated user can update or delete the CLA-configuration for repositories or organizations using CLA-assistant. The stored access tokens for GitHub are not affected, as these are redacted from the API-responses.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/cla-assistant/cla-assistant/security/advisories/GHSA-gw8p-frwv-25gh	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:sap:contributor_license_agreement_assistant:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2023-08-15 17:15

Updated : 2023-08-22 17:32

NVD link : CVE-2023-39438

Mitre link : CVE-2023-39438

CVE.ORG link : CVE-2023-39438

JSON object : View

Products Affected

sap

contributor_license_agreement_assistant

CWE

CWE-862

Missing Authorization

CWE-424

Improper Protection of Alternate Path

CWE-863

Incorrect Authorization

{"id": "CVE-2023-39438", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "cna@sap.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.8}]}, "published": "2023-08-15T17:15:12.627", "references": [{"url": "https://github.com/cla-assistant/cla-assistant/security/advisories/GHSA-gw8p-frwv-25gh", "tags": ["Vendor Advisory"], "source": "cna@sap.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-862"}]}, {"type": "Secondary", "source": "cna@sap.com", "description": [{"lang": "en", "value": "CWE-424"}, {"lang": "en", "value": "CWE-862"}, {"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "A missing authorization check allows an arbitrary authenticated user to perform certain operations through the API of CLA-assistant by executing specific additional steps. This allows an arbitrary authenticated user to read CLA information including information of the persons who signed them as well as custom fields the CLA requester had configured. In addition, an arbitrary authenticated user can update or delete the CLA-configuration for repositories or organizations using CLA-assistant. The stored access tokens for GitHub are not affected, as these are redacted from the API-responses.\n"}, {"lang": "es", "value": "Una comprobaci\u00f3n de autorizaci\u00f3n omitida permite a un usuario autenticado arbitrario realizar ciertas operaciones a trav\u00e9s de la API de CLA-assistant mediante la ejecuci\u00f3n de pasos adicionales espec\u00edficos. Esto permite a un usuario autenticado arbitrario leer informaci\u00f3n CLA incluyendo informaci\u00f3n de las personas que los firmaron as\u00ed como campos personalizados que el solicitante CLA hab\u00eda configurado. Adem\u00e1s, un usuario autenticado arbitrario puede actualizar o eliminar la configuraci\u00f3n CLA para repositorios u organizaciones utilizando CLA-assistant. Los tokens de acceso almacenados para GitHub no se ven afectados, ya que se eliminan de las respuestas de la API."}], "lastModified": "2023-08-22T17:32:59.287", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sap:contributor_license_agreement_assistant:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6EE782C1-8A0C-465E-9D92-CCF68C05AA05", "versionEndExcluding": "2.13.1"}], "operator": "OR"}]}], "sourceIdentifier": "cna@sap.com"}