CVE-2020-15087 - Privilege escalation in Presto

Back Back to CVE browser

HIGH

Privilege escalation in Presto

Published Jun 30, 2020

8.8

HIGH

CVSS 3.1

EPSS 1.06%

Description

In Presto before version 337, authenticated users can bypass authorization checks by directly accessing internal APIs. This impacts Presto server installations with secure internal communication configured. This does not affect installations that have not configured secure internal communication, as these installations are inherently insecure. This only affects Presto server installations. This does NOT affect clients such as the CLI or JDBC driver. This vulnerability has been fixed in version 337. Additionally, this issue can be mitigated by blocking network access to internal APIs on the coordinator and workers.

Affected products

Vendor Prestosql Product Presto Default
n/a
- Version
  < 337
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Prestosql

Presto

n/a

Version	Status	Constraints
< 337	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-285

References (7)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-0484
Advisory
https://github.com/advisories/GHSA-f6pc-crhh-cp96
Advisory
https://github.com/prestosql/presto/security/advisories/GHSA-f6pc-crhh-cp96
x_refsource_CONFIRMThird Party Advisory
https://github.com/trinodb/trino/security/advisories/GHSA-f6pc-crhh-cp96
https://nvd.nist.gov/vuln/detail/CVE-2020-15087
https://prestosql.io/docs/current/release/release-337.html#security-changes
https://trino.io/docs/current/release/release-337.html#security-changes
x_refsource_MISCRelease NotesVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-0484		Advisory
https://github.com/advisories/GHSA-f6pc-crhh-cp96		Advisory
https://github.com/prestosql/presto/security/advisories/GHSA-f6pc-crhh-cp96		x_refsource_CONFIRMThird Party Advisory
https://github.com/trinodb/trino/security/advisories/GHSA-f6pc-crhh-cp96
https://nvd.nist.gov/vuln/detail/CVE-2020-15087
https://prestosql.io/docs/current/release/release-337.html#security-changes
https://trino.io/docs/current/release/release-337.html#security-changes		x_refsource_MISCRelease NotesVendor Advisory