CVE-2023-35167
MediumCVSS 5.0Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
Remult is a CRUD framework for full-stack TypeScript. Using the apiPrefilter option in the @Entity decorator as a function intended to prevent unauthorized access to data may allow an attacker, knowing the id of an entity instance, to gain read, update, and delete access to it.
Risk Assessment
The organization may be exposed to unauthorized access to sensitive data, potentially leading to loss of confidentiality and integrity of information.
Recommendation
It is recommended to upgrade to version 0.20.6 to eliminate this vulnerability. Alternatively, set the apiPrefilter option to a filter object instead of a function.
Original NVD description (English source)
Remult is a CRUD framework for full-stack TypeScript. If you used the apiPrefilter option of the `@Entity` decorator, by setting it to a function that returns a filter that prevents unauthorized access to data, an attacker who knows the `id` of an entity instance is not authorized to access, can gain read, update and delete access to it. The issue is fixed in version 0.20.6. As a workaround, set the `apiPrefilter` option to a filter object instead of a function.