Vulnerability Description
SurrealDB versions before 2.0.4 fail to properly enforce field permissions during SELECT, UPDATE, and DELETE operations, allowing authorized users to access unauthorized field values through various query techniques. Attackers can exploit SELECT VALUE operations, field aliasing, function arguments, WHERE clause filtering, RETURN BEFORE clauses, and SET clause references to leak protected field contents despite lacking SELECT permissions.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Surrealdb | Surrealdb | < 2.0.4 |
Related Weaknesses (CWE)
References
- https://github.com/surrealdb/surrealdb/security/advisories/GHSA-9722-9j67-vjcrVendor Advisory
- https://www.vulncheck.com/advisories/surrealdb-before-improper-authorization-viaThird Party Advisory
FAQ
What is CVE-2024-58367?
CVE-2024-58367 is a vulnerability with a CVSS score of 6.5 (MEDIUM). SurrealDB versions before 2.0.4 fail to properly enforce field permissions during SELECT, UPDATE, and DELETE operations, allowing authorized users to access unauthorized field values through various q...
How severe is CVE-2024-58367?
CVE-2024-58367 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-58367?
Check the references section above for vendor advisories and patch information. Affected products include: Surrealdb Surrealdb.