ArcadeDB Bot Protocol Cross-DB Auth Bypass Allows Metadata Read

Vulnerability Overview The bot protocol in ArcadeDB lacks cross-database authorization, allowing authenticated users to read the schema metadata of another database. This vulnerability enables attackers to read schema metadata of other databases via the bot protocol, even without having access permissions to those databases. Scope of Impact Affected Versions: - ArcadeDB version 24.1.1 and earlier - ArcadeDB version 24.1.0 and earlier - ArcadeDB version 24.0.1 and earlier - ArcadeDB version 24.0.0 and earlier - ArcadeDB version 23.3.1 and earlier - ArcadeDB version 23.3.0 and earlier - ArcadeDB version 23.2.1 and earlier - ArcadeDB version 23.2.0 and earlier - ArcadeDB version 23.1.1 and earlier - ArcadeDB version 23.1.0 and earlier - ArcadeDB version 23.0.1 and earlier - ArcadeDB version 23.0.0 and earlier - ArcadeDB version 22.3.1 and earlier - ArcadeDB version 22.3.0 and earlier - ArcadeDB version 22.2.1 and earlier - ArcadeDB version 22.2.0 and earlier - ArcadeDB version 22.1.1 and earlier - ArcadeDB version 22.1.0 and earlier - ArcadeDB version 22.0.1 and earlier - ArcadeDB version 22.0.0 and earlier - ArcadeDB version 21.3.1 and earlier - ArcadeDB version 21.3.0 and earlier - ArcadeDB version 21.2.1 and earlier - ArcadeDB version 21.2.0 and earlier - ArcadeDB version 21.1.1 and earlier - ArcadeDB version 21.1.0 and earlier - ArcadeDB version 21.0.1 and earlier - ArcadeDB version 21.0.0 and earlier - ArcadeDB version 20.3.1 and earlier - ArcadeDB version 20.3.0 and earlier - ArcadeDB version 20.2.1 and earlier - ArcadeDB version 20.2.0 and earlier - ArcadeDB version 20.1.1 and earlier - ArcadeDB version 20.1.0 and earlier - ArcadeDB version 20.0.1 and earlier - ArcadeDB version 20.0.0 and earlier - ArcadeDB version 19.3.1 and earlier - ArcadeDB version 19.3.0 and earlier - ArcadeDB version 19.2.1 and earlier - ArcadeDB version 19.2.0 and earlier - ArcadeDB version 19.1.1 and earlier - ArcadeDB version 19.1.0 and earlier - ArcadeDB version 19.0.1 and earlier - ArcadeDB version 19.0.0 and earlier - ArcadeDB version 18.3.1 and earlier - ArcadeDB version 18.3.0 and earlier - ArcadeDB version 18.2.1 and earlier - ArcadeDB version 18.2.0 and earlier - ArcadeDB version 18.1.1 and earlier - ArcadeDB version 18.1.0 and earlier - ArcadeDB version 18.0.1 and earlier - ArcadeDB version 18.0.0 and earlier - ArcadeDB version 17.3.1 and earlier - ArcadeDB version 17.3.0 and earlier - ArcadeDB version 17.2.1 and earlier - ArcadeDB version 17.2.0 and earlier - ArcadeDB version 17.1.1 and earlier - ArcadeDB version 17.1.0 and earlier - ArcadeDB version 17.0.1 and earlier - ArcadeDB version 17.0.0 and earlier - ArcadeDB version 16.3.1 and earlier - ArcadeDB version 16.3.0 and earlier - ArcadeDB version 16.2.1 and earlier - ArcadeDB version 16.2.0 and earlier - ArcadeDB version 16.1.1 and earlier - ArcadeDB version 16.1.0 and earlier - ArcadeDB version 16.0.1 and earlier - ArcadeDB version 16.0.0 and earlier - ArcadeDB version 15.3.1 and earlier - ArcadeDB version 15.3.0 and earlier - ArcadeDB version 15.2.1 and earlier - ArcadeDB version 15.2.0 and earlier - ArcadeDB version 15.1.1 and earlier - ArcadeDB version 15.1.0 and earlier - ArcadeDB version 15.0.1 and earlier - ArcadeDB version 15.0.0 and earlier - ArcadeDB version 14.3.1 and earlier - ArcadeDB version 14.3.0 and earlier - ArcadeDB version 14.2.1 and earlier - ArcadeDB version 14.2.0 and earlier - ArcadeDB version 14.1.1 and earlier - ArcadeDB version 14.1.0 and earlier - ArcadeDB version 14.0.1 and earlier - ArcadeDB version 14.0.0 and earlier - ArcadeDB version 13.3.1 and earlier - ArcadeDB version 13.3.0 and earlier - ArcadeDB version 13.2.1 and earlier - ArcadeDB version 13.2.0 and earlier - ArcadeDB version 13.1.1 and earlier - ArcadeDB version 13.1.0 and earlier - ArcadeDB version 13.0.1 and earlier - ArcadeDB version 13.0.0 and earlier - ArcadeDB version 12.3.1 and earlier - ArcadeDB version 12.3.0 and earlier - ArcadeDB version 12.2.1 and earlier - ArcadeDB version 12.2.0 and earlier - ArcadeDB version 12.1.1 and earlier - ArcadeDB version 12.1.0 and earlier - ArcadeDB version 12.0.1 and earlier - ArcadeDB version 12.0.0 and earlier - ArcadeDB version 11.3.1 and earlier - ArcadeDB version 11.3.0 and earlier - ArcadeDB version 11.2.1 and earlier - ArcadeDB version 11.2.0 and earlier - ArcadeDB version 11.1.1 and earlier - ArcadeDB version 11.1.0 and earlier - ArcadeDB version 11.0.1 and earlier - ArcadeDB version 11.0.0 and earlier - ArcadeDB version 10.3.1 and earlier - ArcadeDB version 10.3.0 and earlier - ArcadeDB version 10.2.1 and earlier - ArcadeDB version 10.2.0 and earlier - ArcadeDB version 10.1.1 and earlier - ArcadeDB version 10.1.0 and earlier - ArcadeDB version 10.0.1 and earlier - ArcadeDB version 10.0.0 and earlier - ArcadeDB version 9.3.1 and earlier - ArcadeDB version 9.3.0 and earlier - ArcadeDB version 9.2.1 and earlier - ArcadeDB version 9.2.0 and earlier - ArcadeDB version 9.1.1 and earlier - ArcadeDB version 9.1.0 and earlier - Arcade

Goal Reached Thanks to every supporter — we hit 100%!

ArcadeDB Bot Protocol Cross-DB Auth Bypass Allows Metadata Read

More from this source