title: bytebase - Improper Authorization
description: The “Bytebase” application does not restrict low privilege user to access admin “projects“ for which an unauthorized user can view the “projects“ created by “Admin” and the affected endpoint is “/api/project?user=${userId}”.
problem types: CWE-285 Improper Authorization
affected:
{
product: bytebase
vendor: bytebase
versions:
lessThan: unspecified, status: affected, version: 0.1.0, versionType: custom
lessThanOrEqual: 1.0.4, status: affected, version: unspecified, versionType: custom
}
metrics:
other: [
content: {'attackComplexity': 'LOW', 'attackVector': 'NETWORK', 'availabilityImpact': 'NONE', 'baseScore': 4.3, 'baseSeverity': 'MEDIUM', 'confidentialityImpact': 'LOW', 'integrityImpact': 'NONE', 'privilegesRequired': 'LOW', 'scope': 'UNCHANGED', 'userInteraction': 'NONE', 'vectorString': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N', 'version': 3.1}
type: unknown
]