{"id":"GHSA-ggf6-638m-vqmg","summary":"Netmaker vulnerable to Insufficient Granularity of Access Control","details":"### Impact\nImproper Authorization functions leads to non-privileged users running privileged API calls. If you have added users to your Netmaker platform who whould not have admin privileges, they could use their auth token to run admin-level functions via the API.\n\nIn addition, differing response codes based on function calls allowed non-users to potentially brute force the determination of names of networks on the system.\n\n### Patches\nThis problem has been patched in v0.15.1. To apply:\n\n1. docker-compose down\n2. docker pull gravitl/netmaker:v0.15.1\n3. docker-compose up -d\n\n### For more information\nIf you have any questions or comments about this advisory:\n\nEmail us at [info@netmaker.io](mailto:info@netmaker.io)\nThis vulnerability was brought to our attention by @tweidinger","aliases":["CVE-2022-36110","GO-2022-0986"],"modified":"2024-08-21T16:29:09.239993Z","published":"2022-09-15T03:34:21Z","database_specific":{"github_reviewed_at":"2022-09-15T03:34:21Z","nvd_published_at":"2022-09-09T20:15:00Z","cwe_ids":["CWE-1220","CWE-285"],"severity":"HIGH","github_reviewed":true},"references":[{"type":"WEB","url":"https://github.com/gravitl/netmaker/security/advisories/GHSA-ggf6-638m-vqmg"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-36110"},{"type":"PACKAGE","url":"https://github.com/gravitl/netmaker"},{"type":"WEB","url":"https://github.com/gravitl/netmaker/releases/tag/v0.15.1"}],"affected":[{"package":{"name":"github.com/gravitl/netmaker","ecosystem":"Go","purl":"pkg:golang/github.com/gravitl/netmaker"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.15.1"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/09/GHSA-ggf6-638m-vqmg/GHSA-ggf6-638m-vqmg.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}