Vulnerabilities > CVE-2020-5289 - Files or Directories Accessible to External Parties vulnerability in Elide

CVSS 6.5 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

LOW

Confidentiality impact

HIGH

Integrity impact

NONE

Availability impact

NONE

network

low complexity

elide

CWE-552

NVD

Published: 2020-03-30

Updated: 2024-11-21

Summary

In Elide before 4.5.14, it is possible for an adversary to "guess and check" the value of a model field they do not have access to assuming they can read at least one other field in the model. The adversary can construct filter expressions for an inaccessible field to filter a collection. The presence or absence of models in the returned collection can be used to reconstruct the value of the inaccessible field. Resolved in Elide 4.5.14 and greater.

Vulnerable Configurations

Part	Description	Count
Application	Elide Elide Elide 0.0.1.0 Elide Elide 1.0.0.0 Elide Elide 1.0.0.1 Elide Elide 1.0.0.2 Elide Elide 1.0.0.2.1 Elide Elide 1.0.0.3 Elide Elide 1.0.0.4 Elide Elide 1.0.0.5 Elide Elide 1.0.0.6 Elide Elide 1.0.0.7 Elide Elide 1.0.0.8 Elide Elide 1.0.0.9 Elide Elide 1.0.0.10 Elide Elide 1.0.0.11 Elide Elide 1.0.0.12 Elide Elide 1.0.0.13 Elide Elide 1.0.0.14 Elide Elide 1.0.0.15 Elide Elide 1.0.0.16 Elide Elide 1.0.0.17 Elide Elide 1.0.0.18 Elide Elide 1.0.0.19 Elide Elide 1.0.0.20 Elide Elide 1.0.0.21 Elide Elide 1.0.0.22 Elide Elide 1.0.0.23 Elide Elide 1.0.0.24 Elide Elide 1.0.0.25 Elide Elide 2.0.0 Elide Elide 2.0.1 Elide Elide 2.0.2 Elide Elide 2.0.3 Elide Elide 2.0.4 Elide Elide 2.0.5 Elide Elide 2.0.6 Elide Elide 2.0.7 Elide Elide 2.0.8 Elide Elide 2.0.9 Elide Elide 2.0.10 Elide Elide 2.1.0 Elide Elide 2.2.0 Elide Elide 2.2.1 Elide Elide 2.2.2 Elide Elide 2.3.0 Elide Elide 2.3.1 Elide Elide 2.3.2 Elide Elide 2.3.3 Elide Elide 2.3.4 Elide Elide 2.3.5 Elide Elide 2.3.6 Elide Elide 2.3.7 Elide Elide 2.3.8 Elide Elide 2.3.9 Elide Elide 2.3.10 Elide Elide 2.3.11 Elide Elide 2.3.12 Elide Elide 2.3.13 Elide Elide 2.3.14 Elide Elide 2.3.15 Elide Elide 2.3.16 Elide Elide 2.3.17 Elide Elide 2.4.0 Elide Elide 2.4.1 Elide Elide 2.4.2 Elide Elide 2.4.3 Elide Elide 2.4.4 Elide Elide 2.4.5 Elide Elide 2.4.6 Elide Elide 2.4.7 Elide Elide 2.4.8 Elide Elide 2.4.9 Elide Elide 2.4.10 Elide Elide 2.4.11 Elide Elide 2.4.12 Elide Elide 2.4.13 Elide Elide 2.5.0 Elide Elide 2.5.1 Elide Elide 2.5.2 Elide Elide 3.0.0 Elide Elide 3.0.1 Elide Elide 3.0.2 Elide Elide 3.0.3 Elide Elide 3.0.4 Elide Elide 3.0.5 Elide Elide 3.0.6 Elide Elide 3.0.7 Elide Elide 3.0.8 Elide Elide 3.0.9 Elide Elide 3.0.10 Elide Elide 3.0.11 Elide Elide 3.0.12 Elide Elide 3.0.13 Elide Elide 3.0.14 Elide Elide 3.0.15 Elide Elide 3.0.16 Elide Elide 3.1.0 Elide Elide 3.1.1 Elide Elide 3.1.2 Elide Elide 3.1.3 Elide Elide 3.1.4 Elide Elide 3.2.0 Elide Elide 3.2.1 Elide Elide 3.2.2 Elide Elide 4.0.0 Elide Elide 4.0.1 Elide Elide 4.0.2 Elide Elide 4.1.0 Elide Elide 4.2.0 Elide Elide 4.2.1 Elide Elide 4.2.2 Elide Elide 4.2.3 Elide Elide 4.2.4 Elide Elide 4.2.5 Elide Elide 4.2.6 Elide Elide 4.2.7 Elide Elide 4.2.8 Elide Elide 4.2.9 Elide Elide 4.2.10 Elide Elide 4.2.11 Elide Elide 4.2.12 Elide Elide 4.2.13 Elide Elide 4.2.14 Elide Elide 4.3.0 Elide Elide 4.3.1 Elide Elide 4.3.2 Elide Elide 4.3.3 Elide Elide 4.4.0 Elide Elide 4.4.1 Elide Elide 4.4.2 Elide Elide 4.4.3 Elide Elide 4.4.4 Elide Elide 4.4.5 Elide Elide 4.5.0 Elide Elide 4.5.1 Elide Elide 4.5.2 Elide Elide 4.5.3 Elide Elide 4.5.4 Elide Elide 4.5.5 Elide Elide 4.5.6 Elide Elide 4.5.7 Elide Elide 4.5.8 Elide Elide 4.5.9 Elide Elide 4.5.10 Elide Elide 4.5.11 Elide Elide 4.5.12 Elide Elide 4.5.13	154

Common Weakness Enumeration (CWE)

CWE-552 - Files or Directories Accessible to External Parties

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References