CVE-2023-35167
Medium
Description
Remult is a CRUD framework for full-stack TypeScript. If you used the apiPrefilter option of the `@Entity` decorator, by setting it to a function that returns a filter that prevents unauthorized access to data, an attacker who knows the `id` of an entity instance is not authorized to access, can gain read, update and delete access to it. The issue is fixed in version 0.20.6. As a workaround, set the `apiPrefilter` option to a filter object instead of a function.
SeverityMedium
CVSS5.0
Exploit probability—
ProductRemult
PublishedJun 23, 2023
First seenJun 23, 2023
Weakness typeCWE-284Improper access control
How to fix
Update
- remult remult0.20.6 or later
- remult0.20.6 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| remult remult | v < 0.20.6 | 0.20.6 |
| remultnpm | v < 0.20.6 | 0.20.6 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.