CVE-2020-5289
Read permissions not enforced for client provided filter expressions in Elide http client
In Elide before 4.5.14, it is possible for an adversary to "guess and check" the value of a model field they do not have access to assuming they can read at least one other field in the model. The adversary can construct filter expressions for an inaccessible field to filter a collection. The presence or absence of models in the returned collection can be used to reconstruct the value of the inaccessible field. Resolved in Elide 4.5.14 and greater.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Read permissions not enforced for client provided filter expressions in Elide http client
In Elide before 4.5.14, it is possible for an adversary to "guess and check" the value of a model field they do not have access to assuming they can read at least one other field in the model. The adversary can construct filter expressions for an inaccessible field to filter a collection. The presence or absence of models in the returned collection can be used to reconstruct the value of the inaccessible field. Resolved in Elide 4.5.14 and greater.
- Record
CVE-2020-5289- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N - Weakness
- CWE-285
- Updated
- 2026-11-02
EUVDEUVD-2020-0323
In Elide before 4.5.14, it is possible for an adversary to "guess and check" the value of a model field they do not have access to assuming they can read at least one other field in the model. The adversary can construct filter expressions for an inaccessible field to filter a collection. The presence or absence of models in the returned collection can be used to reconstruct the value of the inaccessible field. Resolved in Elide 4.5.14 and greater.
- Record
EUVD-2020-0323- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-2mxr-89gf-rc4v
Read permissions not enforced for client provided filter expressions in Elide.
Impact
It is possible for an adversary to "guess and check" the value of a model field they do not have access to assuming they can read at least one other field in the model. The adversary can construct filter expressions for an inaccessible field to filter a collection. The presence or absence of models in the returned collection can be used to reconstruct the value of the inaccessible field.
For example, a User model has two fields: name and role. The adversary has read permissions to see the name field of the User collection but not the role. By constructing a filter like the one below, the adversary can determine which users have admin role by presence or absence in the returned collection:
filter=role=="Admin"
Patches
Resolved in Elide 4.5.14 and greater.
Workarounds
The adversary can only access the fields if a model includes fields with different read permission levels (some less secure and some more secure). Model security can be adjusted by restricting read permissions on existing models.
References
Fixed in https://github.com/yahoo/elide/pull/1236
For more information
If you have any questions or comments about this advisory:
- Record
GHSA-2mxr-89gf-rc4v- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N - Weakness
- CWE-285
- Updated
- 2026-11-02
NVD
In Elide before 4.5.14, it is possible for an adversary to "guess and check" the value of a model field they do not have access to assuming they can read at least one other field in the model. The adversary can construct filter expressions for an inaccessible field to filter a collection. The presence or absence of models in the returned collection can be used to reconstruct the value of the inaccessible field. Resolved in Elide 4.5.14 and greater.
- Record
CVE-2020-5289- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - CVSS 2.0
- 4.0 Medium
AV:N/AC:L/Au:S/C:P/I:N/A:N - Weakness
- CWE-285, CWE-552
- Updated
- 2026-11-02
OSV
In Elide before 4.5.14, it is possible for an adversary to "guess and check" the value of a model field they do not have access to assuming they can read at least one other field in the model. The adversary can construct filter expressions for an inaccessible field to filter a collection. The presence or absence of models in the returned collection can be used to reconstruct the value of the inaccessible field. Resolved in Elide 4.5.14 and greater.
- Record
CVE-2020-5289- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVGHSA-2mxr-89gf-rc4v
Read permissions not enforced for client provided filter expressions in Elide.
Impact
It is possible for an adversary to "guess and check" the value of a model field they do not have access to assuming they can read at least one other field in the model. The adversary can construct filter expressions for an inaccessible field to filter a collection. The presence or absence of models in the returned collection can be used to reconstruct the value of the inaccessible field.
For example, a User model has two fields: name and role. The adversary has read permissions to see the name field of the User collection but not the role. By constructing a filter like the one below, the adversary can determine which users have admin role by presence or absence in the returned collection:
filter=role=="Admin"
Patches
Resolved in Elide 4.5.14 and greater.
Workarounds
The adversary can only access the fields if a model includes fields with different read permission levels (some less secure and some more secure). Model security can be adjusted by restricting read permissions on existing models.
References
Fixed in https://github.com/yahoo/elide/pull/1236
For more information
If you have any questions or comments about this advisory:
- Record
GHSA-2mxr-89gf-rc4v- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N - Weakness
- CWE-285
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
com.yahoo.elide:elide-coreMaven |
before 4.5.14 | 4.5.14 |
com.yahoo.elide:elide-coreMaven |
before 4.5.14, plus listed versions 1.0.0.11.0.0.101.0.0.111.0.0.121.0.0.13 Show 45 moreShow less1.0.0.141.0.0.151.0.0.161.0.0.171.0.0.181.0.0.191.0.0.201.0.0.211.0.0.221.0.0.231.0.0.241.0.0.251.0.0.31.0.0.41.0.0.51.0.0.61.0.0.71.0.0.81.0.0.92.0.02.0.12.0.102.0.22.0.32.0.42.0.52.0.62.0.72.0.82.0.92.1.02.2.02.2.12.2.22.3.02.3.12.3.102.3.112.3.122.3.132.3.142.3.152.3.162.3.172.3.2 |
4.5.14 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-5289 is a medium vulnerability (CVSS 6.8) in Elide, published March 30, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.25%, the 69th percentile. Fixed in com.yahoo.elide:elide-core 4.5.14.
References
Left out here: 90 versions. The JSON record has them.