Tolgee up to 3.23.0 API authorization

Summaryinfo

A vulnerability categorized as critical has been discovered in Tolgee up to 3.23.0. This affects an unknown part of the component API. Executing a manipulation can lead to authorization. This vulnerability is registered as CVE-2023-38510. It is possible to launch the attack remotely. No exploit is available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in Tolgee up to 3.23.0. It has been declared as critical. This vulnerability affects an unknown functionality of the component API. The manipulation with an unknown input leads to a authorization vulnerability. The CWE definition for the vulnerability is CWE-862. The product does not perform an authorization check when an actor attempts to access a resource or perform an action. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

Tolgee is an open-source localization platform. Starting in version 3.14.0 and prior to version 3.23.1, when a request is made using an API key, the backend fails to verify the permission scopes associated with the key, effectively bypassing permission checks entirely for some endpoints. It's important to note that this vulnerability only affects projects that have inadvertently exposed their API keys on the internet. Projects that have kept their API keys secure are not impacted. This issue is fixed in version 3.23.1.

The weakness was published 07/27/2023 as GHSA-4f9j-4vh4-p85v. The advisory is shared for download at github.com. This vulnerability was named CVE-2023-38510 since 07/18/2023. There are neither technical details nor an exploit publicly available.

Upgrading to version 3.23.1 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 4776cba67e7bb8c1b0259376e3e5fa3bb46e45c7 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Name

• Tolgee

Version

• 3.0
• 3.1
• 3.2
• 3.3
• 3.4
• 3.5
• 3.6
• 3.7
• 3.8
• 3.9
• 3.10
• 3.11
• 3.12
• 3.13
• 3.14
• 3.15
• 3.16
• 3.17
• 3.18
• 3.19
• 3.20
• 3.21
• 3.22
• 3.23.0

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion