Description
OpenCVE versions 2.4.0 before 3.1.0 fails to properly scope the organizations API endpoint to the token's organization, instead returning the token creator's memberships. Attackers with organization-scoped tokens can list and retrieve every organization their creator belongs to, bypassing intended token isolation boundaries.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| opencve | opencve | 2.4.0 – < 3.1.0 | 3.1.0 |
References
- GitHub Issue #744 exploit technical-description issue-tracking
- opencve v3.1.0 Release Notes release-notes patch
- GitHub Security Advisory (GHSA-xvpw-4gpp-w7h7) vendor-advisory
- VulnCheck Advisory: OpenCVE before 3.1.0 Organization API Ignores Token Scope third-party-advisory