Kinto Attachment's attachments can be replaced on read-only records
Impact
The attachment file of an existing record can be replaced if the user has "read" permission on one of the parent (collection or bucket).
And if the "read" permission is given to "system.Everyone" on one of the parent, then the attachment can be replaced on a record using an anonymous request.
Note that if the parent has no explicit read permission, then the records attachments are safe.
Patches
- Patch released in kinto-attachment 6.4.0
- https://github.com/Kinto/kinto-attachment/commit/f4a31484f5925cbc02b59ebd37554538ab826ca1
Workarounds
None if the read permission has to remain granted.
Updating to 6.4.0 or applying the patch individually (if updating is not feasible) is strongly recommended.
References
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Python (PyPI) | kinto-attachment | < 6.4.0 | 6.4.0 |
Referencias
- https://github.com/Kinto/kinto-attachment/security/advisories/GHSA-hvp4-vrv2-8wrq
- https://github.com/Kinto/kinto-attachment/commit/f4a31484f5925cbc02b59ebd37554538ab826ca1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1879034
- https://github.com/Kinto/kinto-attachment
- https://pypi.org/project/kinto-attachment
- https://github.com/advisories/GHSA-hvp4-vrv2-8wrq
- https://nvd.nist.gov/vuln/detail/CVE-2024-1314
- Vector CVSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N- Debilidad (CWE)
-- Plataforma
- Python (PyPI)
- Paquete
kinto-attachment- Publicada
- 08.02.2024
- Actualizado
- 11.10.2026 13:18
Fuentes y licencias
OSV / GitHub Advisory Database - PYSEC-2026-1494 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-hvp4-vrv2-8wrq - CC BY 4.0
Historial de vulnerabilidades: kinto-attachment
Todas las vulnerabilidades publicadas de este paquete (Python (PyPI)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
Esta es la única vulnerabilidad conocida de este paquete.
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.