github.com/treeverse/lakefs vulnerabilities (Go)
11 vulnerabilities.
-
github.com/treeverse/lakefsGo lakeFS vulnerable to path traversal in local block adapter allow cross-namespace and sibling directory access 8.1 High -
github.com/treeverse/lakefsGo lakeFS is Missing Timestamp Validation in S3 Gateway Authentication 6.5 Medium -
github.com/treeverse/lakefsGo lakeFS: Unauthenticated access to API usage metrics 5.3 Medium -
github.com/treeverse/lakefsGo An authenticated user can crash lakeFS by exhausting server memory 6.5 Medium -
github.com/treeverse/lakefsGo Re-creating a deleted user in lakeFS will re-enable previous user credentials that existed prior to it's deletion 5.7 Medium -
github.com/treeverse/lakefsGo User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository 5.3 Medium -
github.com/treeverse/lakefsGo lakeFS logs S3 credentials in plain text 8.4 High -
github.com/treeverse/lakefsGo User with permission to write actions can impersonate another user when auth token is configured in environment variable 6.2 Medium -
github.com/treeverse/lakefsGo lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files 5.8 Medium -
github.com/treeverse/lakefsGo lakeFS vulnerable to authenticated users deleting files they are not authorized to delete No score -
github.com/treeverse/lakefsGo Improper Access Control in github.com/treeverse/lakefs 5.7 Medium