Homepage About Snyk

Authorization Bypass Affecting io.prestosql:presto-main package, versions [,337)

0.0
high

  • Attack Complexity

    High

  • Confidentiality

    High

  • Integrity

    High

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

  • snyk-id

    SNYK-JAVA-IOPRESTOSQL-575023

  • published

    1 Jul 2020

  • disclosed

    1 Jul 2020

  • credit

    Unknown

Report a new vulnerability Found a mistake?

Introduced: 1 Jul 2020

CVE-2020-15087 Open this link in a new tab
CWE-285 Open this link in a new tab

How to fix?

Upgrade io.prestosql:presto-main to version 337 or higher.

Overview

io.prestosql:presto-main is a distributed SQL query engine for big data.

Affected versions of this package are vulnerable to Authorization Bypass. Authenticated users can bypass authorization checks by directly accessing internal APIs. This impacts Presto server installations with secure internal communication configured. This does not affect installations that have not configured secure internal communication, as these installations are inherently insecure.