GHSA-8jhx-9gf4-hhf5CriticalCVSS 9.8

Consul gem insufficient authentication check - Multiple powers in one controller are not always checked correctly

Published
September 27, 2019
Last Modified
August 29, 2023

🔗 CVE IDs covered (1)

📋 Description

With the consul ruby gem before 1.0.3, if a controller checks multiple powers using :if or :except conditions, these conditions are erroneously applied to all power checks in that controller. This can lead to skipped power checks and hence unauthenticated access to certain controller actions.

🎯 Affected products1

  • rubygems/consul:< 1.0.3

🔗 References (6)