Access Restriction Bypass Affecting @budibase/bbui package, versions <1.3.20
Threat Intelligence
Exploit Maturity
Proof of concept
EPSS
0.05% (23rd
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-BUDIBASEBBUI-5819556
- published 4 Aug 2023
- disclosed 17 Sep 2022
- credit Breno Vitório
How to fix?
Upgrade @budibase/bbui to version 1.3.20 or higher.
Overview
@budibase/bbui is an A UI solution used in the different Budibase projects.
Affected versions of this package are vulnerable to Access Restriction Bypass. Whenever an admin invites people to be in their tenant, there's a risk that one of these app users change their own role to admin and then make the original admin a simple app user, being now capable of doing anything they would want to, including destroy all of a tenant apps or change their content to something else.
References
CVSS Scores
version 3.1