CVE-2018-20345

—

CVSS 3.0

5.3 medium

EPSS

<1%p50

Published

Dec 21, 2018 (Dec 21, 2018)

Modified

Jun 17, 2026

Description

Incorrect access control in StackStorm API (st2api) in StackStorm before 2.9.2 and 2.10.x before 2.10.1 allows an attacker (who has a StackStorm account and is authenticated against the StackStorm API) to retrieve datastore items for other users by utilizing the /v1/keys "?scope=all" and "?user= " query filter parameters. Enterprise editions with RBAC enabled are not affected.

Vendors: stackstorm
Products: stackstorm
Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (0.7%)

In the news0 stories

No ingested article mentions this CVE yet.