Launch Week Day 1: Announcing Security Design Review
CRITICAL 9.8 RubyGems

Consul gem insufficient authentication check - Multiple powers in one controller are not always checked correctly

GHSA-8jhx-9gf4-hhf5 · CVE-2019-16377

Published · Modified

Description

With the consul ruby gem before 1.0.3, if a controller checks multiple powers using :if or :except conditions, these conditions are erroneously applied to all power checks in that controller. This can lead to skipped power checks and hence unauthenticated access to certain controller actions.

Ready to move

Start Securing

Free, no credit card | First findings in minutes