What is CVE-2023-35933?

CVE-2023-35933 is a medium-severity vulnerability in Openfga, classified under Loop with Unreachable Exit Condition (Infinite Loop). CVSS score: 5.9/10. Published 2023-06-26.

How severe is CVE-2023-35933?

Medium severity. CVSS v3 base score is 5.9 out of 10.

Vulnerability in Openfga

CVE-2023-35933

OPenFGA is an open source authorization/permission engine built for developers. OpenFGA versions v1.1.0 and prior are vulnerable to a DoS attack when Check and ListObjects calls are executed against authorization models that contain circular relationship definitions. Users are affected by this vulnerability if they are using OpenFGA v1.1.0 or earlier, and if you are executing `Check` or `ListObjects` calls against a vulnerable authorization model. Users are advised to upgrade to version 1.1.1. There are no known workarounds for this vulnerability. Users that do not have circular relationships in their models are not affected.

EPSS: 0.011 (63.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.9 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H.

Affected products

Openfga — versions < 1.1.1

Weakness classification (CWE)

CWE-835 — Loop with Unreachable Exit Condition (Infinite Loop)

References

security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
security-advisories@github.com (Patch, x_refsource_MISC)
security-advisories@github.com (Exploit, x_refsource_MISC, Vendor Advisory)
security-advisories@github.com (Exploit, x_refsource_MISC, Vendor Advisory)

Frequently asked questions

What is CVE-2023-35933?: CVE-2023-35933 is a medium-severity vulnerability in Openfga, classified under Loop with Unreachable Exit Condition (Infinite Loop). CVSS score: 5.9/10. Published 2023-06-26.
How severe is CVE-2023-35933?: Medium severity. CVSS v3 base score is 5.9 out of 10.