Description
Improper Authorization vulnerability in Apache SkyWalking BanyanDB. The Canopy includes incomplete proof-of-concept role and monitoring-proxy functionality. Under a non-default configuration with a readonly Canopy user and a reachable monitoring target, that user can send non-read requests through the monitoring proxy. This issue affects Apache SkyWalking BanyanDB: from 0.11.0 before 0.11.1. Users are recommended to upgrade to version 0.11.1, which fixes the issue.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Apache Software Foundation Apache SkyWalking BanyanDB
Default version status: unaffected
0.11.0 to < 0.11.1affected
pkg:golang/github.com/apache/skywalking-banyandb