CVE-2022-39340: Incorrect Authorization

October 25, 2022

OpenFGA is an authorization/permission engine. Prior to version 0.2.4, the streamed-list-objects endpoint was not validating the authorization header, resulting in disclosure of objects in the store. Users openfga/openfga versions 0.2.3 and prior who are exposing the OpenFGA service to the internet is vulnerable. Version 0.2.4 contains a patch for this issue.

References

github.com/advisories/GHSA-95x7-mh78-7w2r
github.com/openfga/openfga/commit/779d73d4b6d067ee042ec9b59fec707eed71e42f
github.com/openfga/openfga/releases/tag/v0.2.4
github.com/openfga/openfga/security/advisories/GHSA-95x7-mh78-7w2r
nvd.nist.gov/vuln/detail/CVE-2022-39340

Code Behaviors & Features

Detect and mitigate CVE-2022-39340 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →