CVE - CVE-2023-38510

CVE-ID
CVE-2023-38510	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
Tolgee is an open-source localization platform. Starting in version 3.14.0 and prior to version 3.23.1, when a request is made using an API key, the backend fails to verify the permission scopes associated with the key, effectively bypassing permission checks entirely for some endpoints. It's important to note that this vulnerability only affects projects that have inadvertently exposed their API keys on the internet. Projects that have kept their API keys secure are not impacted. This issue is fixed in version 3.23.1.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MISC:https://github.com/tolgee/tolgee-platform/commit/4776cba67e7bb8c1b0259376e3e5fa3bb46e45c7 URL:https://github.com/tolgee/tolgee-platform/commit/4776cba67e7bb8c1b0259376e3e5fa3bb46e45c7 MISC:https://github.com/tolgee/tolgee-platform/pull/1818 URL:https://github.com/tolgee/tolgee-platform/pull/1818 MISC:https://github.com/tolgee/tolgee-platform/releases/tag/v3.23.1 URL:https://github.com/tolgee/tolgee-platform/releases/tag/v3.23.1 MISC:https://github.com/tolgee/tolgee-platform/security/advisories/GHSA-4f9j-4vh4-p85v URL:https://github.com/tolgee/tolgee-platform/security/advisories/GHSA-4f9j-4vh4-p85v
Assigning CNA
GitHub (maintainer security advisories)
Date Record Created
20230718	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20230718)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)