Threats tagged 'ghsa-grwr-c8jg-hx89'

Eclipse BaSyx Go Components versions up to and including 1.1.2 have an access control vulnerability in ABAC-enabled deployments of the Submodel Repository and AAS Environment. Specifically, certain GET requests for single Submodels and their metadata do not apply FILTERLIST fragment filters, allowing authenticated users with READ access to view fields that should be hidden by access rules. Additionally, when versioning is enabled, history endpoints return unfiltered data, exposing hidden fields and entire Submodels or Asset Administration Shells that should be restricted. This issue is fixed in version 1.1.3.