QwikSec

Security Database

CVE

CWE

Training

CVE-2023-38510

Published: Jul 27, 2023

Modified: Oct 3, 2024

PUBLISHED

CVSS v3.1

8.1

HIGH

Description

Tolgee is an open-source localization platform. Starting in version 3.14.0 and prior to version 3.23.1, when a request is made using an API key, the backend fails to verify the permission scopes associated with the key, effectively bypassing permission checks entirely for some endpoints. It's important to note that this vulnerability only affects projects that have inadvertently exposed their API keys on the internet. Projects that have kept their API keys secure are not impacted. This issue is fixed in version 3.23.1.

Vendor	Product	Versions
tolgee	tolgee-platform	affected `>= 3.14.0, < 3.23.1`

Weaknesses (CWE)

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

References

https://github.com/tolgee/tolgee-platform/security/advisories/GHSA-4f9j-4vh4-p85v

x_refsource_CONFIRM

https://github.com/tolgee/tolgee-platform/pull/1818

x_refsource_MISC

https://github.com/tolgee/tolgee-platform/commit/4776cba67e7bb8c1b0259376e3e5fa3bb46e45c7

x_refsource_MISC

https://github.com/tolgee/tolgee-platform/releases/tag/v3.23.1

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.