CVE-2018-20345 - CVE House
Back to Database
Status published Medium CVE-2018-20345

Incorrect access control in StackStorm API (st2api) in StackStorm before...

Vulnerability Description

Incorrect access control in StackStorm API (st2api) in StackStorm before 2.9.2 and 2.10.x before 2.10.1 allows an attacker (who has a StackStorm account and is authenticated against the StackStorm API) to retrieve datastore items for other users by utilizing the /v1/keys "?scope=all" and "?user=<username>" query filter parameters. Enterprise editions with RBAC enabled are not affected.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2018-20345

Credits & Attribution

No credits recorded in the NVD database.

References

More from stackstorm

View All →
CVE-2022-44009
Improper access control in Key-Value RBAC in StackStorm version 3.7.0...
Unknown 0
CVE-2022-43706
Cross-site scripting (XSS) vulnerability in the Web UI of StackStorm...
Unknown 0
CVE-2021-44657
In StackStorm versions prior to 3.6.0, the jinja interpreter was...
High 8.8
CVE-2021-28667
StackStorm before 3.4.1, in some situations, has an infinite loop...
High 7.5
CVE-2019-9580
In st2web in StackStorm Web UI before 2.9.3 and 2.10.x...
Medium 6.1

Affected Vendor

Affected Software

stackstorm
Vulnerable Versions:
0, 2.10.0

Timeline

Official Publish: December 21st, 2018
Last Modified: September 17th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.