EIQ-2020-0007



ID

EIQ-2020-0007

CVE

-

Description

A signed-in user can gain unauthorized access to workspaces

Date

10 Feb 2020

Severity

4 - CRITICAL

CVSSv3 score

CVSSv3 score not available on NIST NVD.

Status

images/s/-u524h5/8501/61630d2d4f75946459caa0b3dbdac9bd6d7a7de4/_/images/icons/emoticons/check.svg 2.7.0

Assessment

A signed-in platform user without admin access rights, and with at least the modify workspaces permission can gain unauthorized access to any platform workspaces, even if the user is not a workspace collaborator.
 To do so, a signed-in platform user must have the ID of the workspace they want to access.

User roles and group roles are not validated correctly in the backend.
This enables a user to send POST and PUT requests with the ID of the workspace they want to access in the request body.

We plan to implement stricter backend checking for user roles and group roles from release 2.7.0 to intercept and to block unauthorized workspace access through POST and PUT requests that try to pass tampered request body data.

Mitigation

Upgrade to EclecticIQ Platform 2.7.0 or later.

Affected versions

2.6.0 and earlier.

Notes

-

< Back to all security issues and mitigation actions


In release notes 2.7.0